Moderate Security Vulnerability in Python 3.12: Excessive Read Buffering and Quadratic Algorithm DoS
Summary
RLSA-2026:1828: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.12-3.el10_1. Fixed in 0:3.12.12-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for various applications, including web development, data analysis, artificial intelligence, and more. However, recent vulnerabilities have been identified that could lead to denial of service (DoS) attacks, affecting the stability and security of applications built with this version.
Vulnerability Detail
The vulnerabilities identified in Python 3.12 include excessive read buffering in the http.client module (CVE-2025-13836) and a quadratic algorithm issue in the xml.dom.minidom module (CVE-2025-12084). These vulnerabilities can be exploited to cause denial of service by overwhelming the system with excessive resource consumption, leading to application crashes or unresponsiveness. The excessive read buffering allows attackers to send large amounts of data that the application cannot handle efficiently, while the quadratic algorithm can lead to performance degradation as the input size increases.
How To Fix
Minimum fixed version
0:3.12.12-3.el10_1
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on the affected modules to mitigate the risk of denial of service attacks. Additionally, avoid processing untrusted input in the xml.dom.minidom module until the update is applied.
Conclusion
In summary, Python 3.12 has been identified with moderate security vulnerabilities that could lead to denial of service attacks. It is crucial to update to the patched version to ensure the security and stability of applications. Utilize tools like Vulert to monitor for vulnerabilities and stay informed about potential risks.
See every vulnerability recorded for python3.12 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The potential impacts include denial of service, application crashes, and unresponsiveness, which can affect user experience and system reliability.
Yes, Python 3.12 is the specific version that contains the vulnerabilities related to excessive read buffering and quadratic algorithm issues.
If you cannot update immediately, consider implementing rate limiting and avoiding untrusted input processing in the affected modules as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
