Critical Resource Consumption Vulnerability in Python 3.11
Summary
RLSA-2025:3634: Low: python3.11 security update. Affects python3.11 versions < 0:3.11.9-7.el9_5.3. Fixed in 0:3.11.9-7.el9_5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python 3.11 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features modules, classes, exceptions, and dynamic data types, making it versatile and powerful. However, it is susceptible to vulnerabilities that can affect its performance and security, such as the recent issue identified in the http.cookies module.
Vulnerability Detail
The vulnerability, identified as CVE-2024-7592, pertains to uncontrolled CPU resource consumption within the http.cookies module of Python 3.11. This flaw can lead to significant performance degradation, potentially causing denial of service (DoS) conditions if exploited. Attackers can craft specific inputs that trigger excessive CPU usage, impacting the availability of applications relying on this module. The CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:3.11.9-7.el9_5.3
This is the first release that contains the fix.
sudo dnf update python3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input size or sanitize inputs to the http.cookies module to mitigate the risk of triggering the vulnerability until the package is updated.
Conclusion
In summary, the CVE-2024-7592 vulnerability in Python 3.11 poses a risk of uncontrolled CPU resource consumption, which can affect application performance. Users are advised to update to the patched version to mitigate this risk. Temporary workarounds are available, but a permanent fix through updates is recommended.
See every vulnerability recorded for python3.11 →
FAQ
CVE-2024-7592 is a vulnerability in Python 3.11 that allows for uncontrolled CPU resource consumption in the http.cookies module.
Exploitation of this vulnerability can lead to excessive CPU usage, potentially causing your application to slow down or become unresponsive.
If an immediate update is not possible, consider implementing input validation or limiting the size of inputs to the http.cookies module as a temporary measure.
Detailed information about CVE-2024-7592 can be found on the official CVE page and through security advisories from the Rocky Enterprise Software Foundation and Red Hat.
Vulert provides a service that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json, alerting you in real-time about any issues.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
