◐ Shell
clean mode source ↗

gh-119451: Fix a potential denial of service in http.client by serhiy-storchaka · Pull Request #119454 · python/cpython

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka changed the title gh-119451: Fix OOM vulnerability in http.client gh-119451: Fix a potential denial of service in http.client

Nov 18, 2025

illia-v

@serhiy-storchaka

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Dec 1, 2025
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Dec 1, 2025
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Dec 1, 2025
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

hugovk pushed a commit that referenced this pull request

Dec 1, 2025

Yhg1s pushed a commit that referenced this pull request

Dec 5, 2025
…H-119454) (#142139)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

StanFromIreland pushed a commit to StanFromIreland/cpython that referenced this pull request

Dec 6, 2025
…thonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.

Yhg1s pushed a commit that referenced this pull request

Dec 22, 2025
…H-119454) (#142140)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request

Jan 16, 2026
pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request

Jan 16, 2026
[3.12] pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454) (python#142140)

pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

pablogsal pushed a commit that referenced this pull request

Jan 25, 2026
…H-119454) (#142142)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

pablogsal pushed a commit that referenced this pull request

Jan 25, 2026
…H-119454) (#142141)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

hrnciar pushed a commit to fedora-python/cpython that referenced this pull request

Feb 6, 2026
[3.12] pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454) (python#142140)

pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

hrnciar pushed a commit to fedora-python/cpython that referenced this pull request

Feb 6, 2026
pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

hrnciar pushed a commit to fedora-python/cpython that referenced this pull request

Feb 6, 2026
[3.12] pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454) (python#142140)

pythongh-119451: Fix a potential denial of service in http.client (pythonGH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a0)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

This was referenced

Mar 13, 2026