◐ Shell
reader mode source ↗
Skip to content

gh-119451: Fix a potential denial of service in http.client#119454

Merged
serhiy-storchaka merged 8 commits into
python:mainfrom
serhiy-storchaka:http-client
Dec 1, 2025
Merged

gh-119451: Fix a potential denial of service in http.client#119454
serhiy-storchaka merged 8 commits into
python:mainfrom
serhiy-storchaka:http-client

Conversation

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka commented May 23, 2024 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

Reading the whole body of the HTTP response could cause OOM if the Content-Length value is too large even if the server does not send a large amount of data. Now the HTTP client reads large data by chunks, therefore the amount of consumed memory is proportional to the amount of sent data.

@serhiy-storchaka
pythongh-119451: Fix OOM vulnerability in http.client …
25166b1 
Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
@bedevere-app bedevere-app Bot mentioned this pull request May 23, 2024
Closed
@serhiy-storchaka serhiy-storchaka added type-security A security issue needs backport to 3.8 needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels May 23, 2024
@gpshead gpshead marked this pull request as draft May 24, 2024 19:58
@gpshead

gpshead commented May 24, 2024

Copy link
Copy Markdown
Member

I've marked this Draft for now as discussion on this on the security response team list is not complete. (we'll summarize that in a public issue once it has settled)

@gpshead gpshead mentioned this pull request Jan 20, 2025
Merged
@encukou

encukou commented Jan 27, 2025

Copy link
Copy Markdown
Member

See #119514 (comment) for results of the PSRT discussion.

@serhiy-storchaka serhiy-storchaka added the needs backport to 3.14 bugs and security fixes label May 8, 2025
@serhiy-storchaka serhiy-storchaka changed the title gh-119451: Fix OOM vulnerability in http.client Nov 18, 2025
@serhiy-storchaka serhiy-storchaka marked this pull request as ready for review November 18, 2025 13:44
143 hidden items Load more…
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Dec 1, 2025
@serhiy-storchaka @miss-islington
pythongh-119451: Fix a potential denial of service in http.client (py… …
03336d7 
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app

bedevere-app Bot commented Dec 1, 2025

Copy link
Copy Markdown

GH-142139 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Dec 1, 2025
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Dec 1, 2025
@serhiy-storchaka @miss-islington
pythongh-119451: Fix a potential denial of service in http.client (py… …
4f2bc24 
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app

bedevere-app Bot commented Dec 1, 2025

Copy link
Copy Markdown

GH-142140 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Dec 1, 2025
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Dec 1, 2025
@serhiy-storchaka @miss-islington
pythongh-119451: Fix a potential denial of service in http.client (py… …
b3a7998 
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app

bedevere-app Bot commented Dec 1, 2025

Copy link
Copy Markdown

GH-142141 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Dec 1, 2025
@bedevere-app

bedevere-app Bot commented Dec 1, 2025

Copy link
Copy Markdown

GH-142142 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Dec 1, 2025
@bedevere-bot

bedevere-bot commented Dec 1, 2025

Copy link
Copy Markdown

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Debian root 3.x (tier-1) has failed when building commit 5a4c4a0.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/345/builds/12794) and take a look at the build logs.
  4. Check if the failure is related to this commit (5a4c4a0) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/345/builds/12794

Summary of the results of the build (if available):

==

Click to see traceback logs 
Traceback (most recent call last):
  File "/root/buildarea/3.x.angelico-debian-amd64/build/Lib/test/support/__init__.py", line 847, in gc_collect
    gc.collect()
    ~~~~~~~~~~^^
ResourceWarning: unclosed file <_io.FileIO name=13 mode='wb' closefd=True>


Traceback (most recent call last):
  File "/root/buildarea/3.x.angelico-debian-amd64/build/Lib/test/support/__init__.py", line 847, in gc_collect
    gc.collect()
    ~~~~~~~~~~^^
ResourceWarning: unclosed file <_io.FileIO name=11 mode='wb' closefd=True>

@illia-v

illia-v commented Dec 1, 2025

Copy link
Copy Markdown
Contributor

This is a different kind of error, less critical. You can easily catch OverflowError in the user code, or clip the limit to the reasonable size (it should not be larger than the buffer size) before call. It will not lead to overallocation.

I see, thanks for explaining and fixing the current issue!

hugovk pushed a commit that referenced this pull request Dec 1, 2025
@miss-islington @serhiy-storchaka
[3.14] gh-119451: Fix a potential denial of service in http.client (G… …
4ce2790 
…H-119454) (#142138)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Yhg1s pushed a commit that referenced this pull request Dec 5, 2025
@miss-islington @serhiy-storchaka
[3.13] gh-119451: Fix a potential denial of service in http.client (G… …
289f29b 
…H-119454) (#142139)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
StanFromIreland pushed a commit to StanFromIreland/cpython that referenced this pull request Dec 6, 2025
@serhiy-storchaka @StanFromIreland
pythongh-119451: Fix a potential denial of service in http.client (py… …
58c065e 
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
Yhg1s pushed a commit that referenced this pull request Dec 22, 2025
@miss-islington @serhiy-storchaka
[3.12] gh-119451: Fix a potential denial of service in http.client (G… …
14b1fdb 
…H-119454) (#142140)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Jan 16, 2026
@serhiy-storchaka @frenzymadness
00472: CVE-2025-13836 …
f5c928e 
pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@frenzymadness frenzymadness mentioned this pull request Jan 16, 2026
Merged
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Jan 16, 2026
@miss-islington @serhiy-storchaka @frenzymadness
00472: CVE-2025-13836 …
4ab6f2e 
[3.12] pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454) (python#142140)

pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@frenzymadness frenzymadness mentioned this pull request Jan 16, 2026
Merged
pablogsal pushed a commit that referenced this pull request Jan 25, 2026
@miss-islington @serhiy-storchaka
[3.10] gh-119451: Fix a potential denial of service in http.client (G… …
5dc1016 
…H-119454) (#142142)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
pablogsal pushed a commit that referenced this pull request Jan 25, 2026
@miss-islington @serhiy-storchaka
[3.11] gh-119451: Fix a potential denial of service in http.client (G… …
afc40bd 
…H-119454) (#142141)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@github-actions github-actions Bot mentioned this pull request Jan 26, 2026
Closed
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 6, 2026
@miss-islington @serhiy-storchaka @hrnciar
00472: CVE-2025-13836 …
3f93d34 
[3.12] pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454) (python#142140)

pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 6, 2026
@serhiy-storchaka @hrnciar
00472: CVE-2025-13836 …
1637f5d 
pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Feb 6, 2026
@miss-islington @serhiy-storchaka @hrnciar
00472: CVE-2025-13836 …
0ff8a04 
[3.12] pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454) (python#142140)

pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This was referenced Mar 13, 2026
Closed
Closed
@lpasquali lpasquali mentioned this pull request Apr 6, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

+1 more reviewer

@illia-v illia-v illia-v left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@serhiy-storchaka @gpshead @encukou @illia-v @bedevere-bot @ambv @hugovk @nazeerali4325-commits