Mailman 3 December 2025 - Security-announce

[CVE-2025-12084] Quadratic complexity in node ID cache clearing
by Seth Larson Dec. 3, 2025

Dec. 3, 2025

There is a MEDIUM severity vulnerability affecting CPython. When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2025-12084 * https://github.com/python/cpython/pull/142146

1 0

[CVE-2025-13837] Out-of-memory when loading Plist
by Seth Larson Dec. 1, 2025

Dec. 1, 2025

There is a LOW severity vulnerability affecting CPython. When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2025-13837 * https://github.com/python/cpython/pull/119343

1 0

[CVE-2025-13836] Excessive read buffering DoS in http.client
by Seth Larson Dec. 1, 2025

Dec. 1, 2025

There is a MEDIUM severity vulnerability affecting CPython. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2025-13836 * https://github.com/python/cpython/pull/119454

1 0