Home > Vulnerability Database > CVE-2025-13837

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2025-13837

Good to know:

Date: December 1, 2025

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Severity Score

4.3

Related Resources (8)

Url: https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/

Url: https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb

Url: https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba

Url: https://github.com/python/cpython/issues/119342

Url: https://github.com/python/cpython/pull/119343

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-13837

Url: https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70

Url: https://www.mend.io/vulnerability-database/CVE-2025-13837

Severity Score

4.3

Weakness Type (CWE)

Uncontrolled Resource Consumption

CWE-400

Top Fix

Upgrade Version

Upgrade to version https://github.com/python/cpython.git - v3.13.10;https://github.com/python/cpython.git - v3.14.1

CVSS v3.1

Base Score:	4.3
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	CHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	LOW

Do you need more information?

Contact Us