Aller au contenu
en Se connecter
8.7 Élevée

CVE-2024-12254 Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and…

Description

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Produits et versions touchés

Produit Versions touchées Corrigé en
CPython 3.14 3.14.0a1 → < 3.14.0a3 3.14.0a3
CPython 3.13 3.13.0 → < 3.13.2 3.13.2
CPython 3.12 premières → < 3.12.9 3.12.9
cpython 3.12 3.12.0 → < 3.14.0a1 3.14.0a1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de CPython

Les 79 CVE de CPython →
CVE-2026-116566 socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be… 5.3 Moyenne CVE-2026-103995 Lenient parsing of integers for response body and chunk framing 2.0 Faible CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without… 9.4 Critique CVE-2026-114583 tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like… 6.9 Moyenne
Suivre cette CVE