CVE-2025-13836 — Excessive read buffering DoS in http.client
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the clie…
Published: 2025-12-01 · CVSS: 6.3 · CVSS 4.0
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7