Moderate Security Vulnerability in Python 3.12: Denial of Service Risks
Summary
RLSA-2026:1408: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.12-4.el9_7. Fixed in 0:3.12.12-4.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports modules, classes, exceptions, and dynamic data types, making it suitable for various applications, from web development to data analysis. However, recent vulnerabilities have been identified that could lead to denial of service attacks, affecting the stability and security of applications built using this version.
Vulnerability Detail
The vulnerabilities identified in Python 3.12 include excessive read buffering in the http.client module and a quadratic algorithm in the xml.dom.minidom module. The excessive read buffering can be exploited to cause a denial of service (DoS) by overwhelming the server with excessive data requests. The quadratic algorithm vulnerability can also lead to DoS by consuming excessive resources when processing XML documents, potentially crashing the application or making it unresponsive.
How To Fix
Minimum fixed version
0:3.12.12-4.el9_7
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the input size for XML documents and implementing rate limiting on HTTP requests to mitigate the impact of these vulnerabilities until the update can be applied.
Conclusion
In summary, Python 3.12 has been identified with moderate security vulnerabilities that could lead to denial of service attacks. It is crucial to update to the latest patched version to ensure the security and stability of your applications. Temporary workarounds can be implemented while awaiting the update.
See every vulnerability recorded for python3.12 →
FAQ
The main vulnerabilities include excessive read buffering in http.client and a quadratic algorithm in xml.dom.minidom, both of which can lead to denial of service attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a moderate severity level.
If an immediate update is not possible, implement input size restrictions for XML documents and apply rate limiting on HTTP requests as temporary workarounds.
The vulnerabilities are addressed by the Rocky Enterprise Software Foundation and Red Hat, who provide security updates and patches for Python.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
