OOM a potential denial of service in the CGI server on Windows

When http.server.CGIHTTPRequestHandler on Windows (and other platforms without fork()) handles the POST request, it reads the whole body of the POST request in memory before sending it to the subprocess running the script. The underlying SocketIO allocates the amount of memory specified in the Content-Length header before actual reading the data, so a small request with incorrect Content-Length can cause consumption of the large amount of memory and CPU time and can be used in the DOS attack on the server.

Linked PRs

Yes we need because those versions are still supported from a security perspective. So only 3.9-3.14 fixes.

pythongh-119452: Fix OOM vulnerability in http.server

[3.14] gh-119452: Fix a potential virtual memory allocation denial of…

[3.14] pythongh-119452: Fix a potential virtual memory allocation den…

[3.13] gh-119452: Fix a potential virtual memory allocation denial of…

@colesbury

@colesbury flagged a buildbot failure - #119455 (comment)

looks like the select is non-blocking rather than blocking when we still needed more data. https://github.com/python/cpython/pull/119455/files#r2580013415

pythongh-119452: Remove select and 'truncated' test

pythongh-119452: Remove select, skip 'truncated' test

[3.14] Try to fix the fix for pythongh-119452

Revert "[3.14] pythongh-119452: Fix a potential virtual memory alloca…

Revert "[3.13] pythongh-119452: Fix a potential virtual memory alloca…

[3.13] Revert "gh-119452: Fix a potential virtual memory allocation d…

[3.14] Revert "gh-119452: Fix a potential virtual memory allocation d…

pythongh-119452: Fix OOM vulnerability in http.server

[3.14] pythongh-119452: Fix a potential virtual memory allocation den…

[3.14] gh-119452: Fix a potential virtual memory allocation denial of…

[3.14] pythongh-119452: Fix a potential virtual memory allocation den…

[3.13] gh-119452: Fix a potential virtual memory allocation denial of…

[3.12] gh-119452: Fix a potential virtual memory allocation denial of…

[3.10] gh-119452: Fix a potential virtual memory allocation denial of…

[3.11] gh-119452: Fix a potential virtual memory allocation denial of…

All the backports are merged now.

The test is a little bit fragile. Example of failure on "AMD64 FreeBSD Refleaks 3.13" buildbot: https://buildbot.python.org/#/builders/1615/builds/1722

ERROR: test_large_content_length_truncated (test.test_httpservers.CGIHTTPServerTestCase.test_large_content_length_truncated)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/buildbot/buildarea/3.13.ware-freebsd.refleak/build/Lib/test/test_httpservers.py", line 1028, in test_large_content_length_truncated
    res = self.request('/cgi-bin/file1.py', 'POST', b'x', headers)
  File "/buildbot/buildarea/3.13.ware-freebsd.refleak/build/Lib/test/test_httpservers.py", line 89, in request
    return self.connection.getresponse()
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/buildbot/buildarea/3.13.ware-freebsd.refleak/build/Lib/http/client.py", line 1450, in getresponse
    response.begin()
    ~~~~~~~~~~~~~~^^
  File "/buildbot/buildarea/3.13.ware-freebsd.refleak/build/Lib/http/client.py", line 336, in begin
    version, status, reason = self._read_status()
                              ~~~~~~~~~~~~~~~~~^^
  File "/buildbot/buildarea/3.13.ware-freebsd.refleak/build/Lib/http/client.py", line 297, in _read_status
    line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
               ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^
  File "/buildbot/buildarea/3.13.ware-freebsd.refleak/build/Lib/socket.py", line 723, in readinto
    return self._sock.recv_into(b)
           ~~~~~~~~~~~~~~~~~~~~^^^
ConnectionResetError: [Errno 54] Connection reset by peer

One explanation is the hardcoded timeout of 1 ms in the test:

with support.swap_attr(self.request_handler, 'timeout', 0.001):

This timeout is too low if the machine running the test has high system load.

For example, ./python -m test test_httpservers -v -m test_large_content_length_truncated -F -j10 fails quickly.

[3.14] gh-119452: test_large_content_length_truncated: Don't use the …

[3.13] gh-119452: test_large_content_length_truncated: Don't use the …

Navigation Menu

Repository navigation

OOM a potential denial of service in the CGI server on Windows #119452

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

OOM a potential denial of service in the CGI server on Windows #119452

Description

Linked PRs

Activity

picnixz commented on Oct 26, 2025

gpshead commented on Dec 2, 2025

encukou commented on Jan 26, 2026

vstinner commented on May 13, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions