[3.13] gh-119451: Fix a potential denial of service in http.client (GH-119454) (...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Fri, 5 Dec 2025 15:21:57 +0000 (16:21 +0100)
committerArnaud Rebillout <arnaudr@debian.org>
Tue, 14 Apr 2026 04:38:32 +0000 (11:38 +0700)
commitf62aef0f11675d0bc51bed8876c43019ea62f7be
treeffa469b1988c1d9bad3c0a4514846f7b9bdf174f
parentae24ecc4ebd3148a2fac7e06228579f38b47a00a
[3.13] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142139)

gh-119451: Fix a potential denial of service in http.client (GH-119454)

Reading the whole body of the HTTP response could cause OOM if
the Content-Length value is too large even if the server does not send
a large amount of data. Now the HTTP client reads large data by chunks,
therefore the amount of consumed memory is proportional to the amount
of sent data.
(cherry picked from commit 5a4c4a033a4a54481be6870aa1896fad732555b5)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Origin: upstream, https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15

Gbp-Pq: Name CVE-2025-13836.patch
Lib/http/client.py
Lib/test/test_httplib.py
Misc/NEWS.d/next/Security/2024-05-23-11-47-48.gh-issue-119451.qkJe9-.rst [new file with mode: 0644]