Memory Exhaustion Vulnerability in Python 3.13 Due to Asyncio Buffer Management
Summary
DEBIAN-CVE-2024-12254: Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark"... Affects python3.13 versions < 3.13.1-2. Fixed in 3.13.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.13 is a widely used programming language known for its simplicity and versatility. It includes a robust asyncio module that allows for asynchronous programming, enabling developers to write concurrent code using the async/await syntax. However, a recent vulnerability has been identified in the asyncio._SelectorSocketTransport.writelines() method, which can lead to memory exhaustion under specific conditions.
Vulnerability Detail
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method fails to pause writing and signal to the Protocol to drain the buffer once the write buffer reaches the high-water mark. This oversight can prevent Protocols from periodically draining the write buffer, potentially leading to memory exhaustion. This vulnerability affects users running Python 3.12.0 or later on macOS or Linux, utilizing the asyncio module with protocols and the .writelines() method, which introduced new zero-copy-on-write behavior.
How To Fix
Minimum fixed version
3.13.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the .writelines() method in their asyncio protocols until the package is updated. Instead, consider using alternative methods for writing data that do not trigger this vulnerability.
Conclusion
The vulnerability in Python 3.13 related to the asyncio._SelectorSocketTransport.writelines() method poses a risk of memory exhaustion for users under specific conditions. It is crucial to update to the patched version to mitigate this risk and ensure the stability of applications using this functionality.
See every vulnerability recorded for python3.13 →
FAQ
The vulnerability can lead to memory exhaustion, which may cause applications to crash or become unresponsive.
Users of Python 3.12.0 or later on macOS or Linux who utilize the asyncio module with protocols and the .writelines() method are affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is impacted without requiring any signup.
Yes, updating to the patched version 3.13.1-2 or later will resolve the vulnerability.
If an immediate update is not possible, avoid using the .writelines() method in your code as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.13.
