Repository navigation
Out-of-memory when loading a Plist #119342
Description
The plistlib module is vulnerable to OOM. It reads from the file the amount of data specified in the file (which can be up to 2**64 bytes), and both FileIO,read() and BufferedReader.read() preallocates the bytes object of the specified size. Specially prepared Plist file can be used to organize a DOS attack.
Linked PRs
- gh-119342: Fix a potential denial of service in plistlib #119343
- [3.14] gh-119342: Fix a potential denial of service in plistlib (GH-119343) #142143
- [3.13] gh-119342: Fix a potential denial of service in plistlib (GH-119343) #142144
- [3.12] gh-119342: Fix a potential denial of service in plistlib (GH-119343) #142149
- [3.11] gh-119342: Fix a potential denial of service in plistlib (GH-119343) #142150
- [3.10] gh-119342: Fix a potential denial of service in plistlib (GH-119343) #142151
Activity
pythongh-119342: Fix a potential denial of service in plistlib (pytho…
pythongh-119342: Fix a potential denial of service in plistlib (pytho…
[3.13] gh-119342: Fix a potential denial of service in plistlib (GH-1…
[3.12] pythongh-119342: Fix a potential denial of service in plistlib (…
[3.14] gh-119342: Fix a potential denial of service in plistlib (GH-1…
[3.11] pythongh-119342: Fix a potential denial of service in plistlib (…
[3.10] pythongh-119342: Fix a potential denial of service in plistlib (…
z00z00z00 commentedon Dec 3, 2025
The CVE assigned is CVE-2025-13837
pythongh-119342: Fix a potential denial of service in plistlib (pytho…
[3.12] gh-119342: Fix a potential denial of service in plistlib (GH-1…
[3.10] gh-119342: Fix a potential denial of service in plistlib (GH-1…
[3.11] gh-119342: Fix a potential denial of service in plistlib (GH-1…
[CVE-2025-13837] fix a potential denial of service in plistlib
[CVE-2025-13837] fix a potential denial of service in plistlib
[CVE-2025-13837] fix a potential denial of service in plistlib
[CVE-2025-13837] fix a potential denial of service in plistlib