CVE-2025-13837

MEDIUM

Published Dec 1, 2025 Modified Mar 3, 2026 CWE-400

Description

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-400 Uncontrolled Resource Consumption

Affected Products

Vendor	Product	Versions
python	python	< 3.13.10
python	python	3.14.0 — 3.14.1
python	python	All
python	python	All

References

Advisories & Patches

https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70 https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb https://github.com/python/cpython/issues/119342 https://github.com/python/cpython/pull/119343 https://mail.python.org/archives/list/[email protected]/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/

Other References

https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036 https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111

Frequently Asked Questions

What is CVE-2025-13837? +

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-13837? +

CVE-2025-13837 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-13837? +

CVE-2025-13837 affects products from python, specifically: python. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-13837? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42343

FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation …

CVE-2026-48593

Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unbounded cron range expansion. An attacker with …

CVE-2025-41361

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, …

CVE-2025-41360

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of …

CVE-2024-5422

An uncontrolled resource consumption of file descriptors in SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 allows …

CVE-2025-50057

A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered. The issue allows unauthenticated remote attackers to deny access to …

Quick Facts

CVSS Score: 5.5
Severity: MEDIUM
Published: Dec 1, 2025

Scan for this vulnerability

Check if your website or infrastructure is affected by CVE-2025-13837.

Website Scan Port Scan

Browse CVEs

Critical High CISA KEV ! Most likely exploited →