--- id: CVE-2018-20406 title: >- Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt summary: >- Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle f… severity: high cvss: 7.5 cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-190 vendor: python product: python affected: - 'python >= 3.4.0, < 3.7.1' - debian_linux = 8.0 - fedora = 28 - fedora = 29 - fedora = 30 patched: - python 3.7.1 published: '2018-12-23' updated: '2026-10-15' sourceUpdated: '2026-10-15T18:17:19.650' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-20406' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:3725' label: cve@mitre.org - url: 'https://bugs.python.org/issue34656' label: cve@mitre.org - url: >- https://github.com/python/cpython/commit/a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/ label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20190416-0010/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4127-1/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4127-2/' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3725' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugs.python.org/issue34656' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/python/cpython/commit/a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190416-0010/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4127-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4127-2/' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - cve.org ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-10-15T17:41:22.735528Z' epss: 0.05789 epssPercentile: 0.93064 ingestedAt: '2026-10-15T18:23:58.400Z' --- ## Overview Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. This issue is fixed in: v3.4.10, v3.4.10rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.7rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.7, v3.6.7rc1, v3.6.7rc2, v3.6.8, v3.6.8rc1, v3.6.9, v3.6.9rc1; v3.7.1, v3.7.1rc1, v3.7.1rc2, v3.7.2, v3.7.2rc1, v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. ## Affected - `python >= 3.4.0, < 3.7.1` - `debian_linux = 8.0` - `fedora = 28` - `fedora = 29` - `fedora = 30` ## Remediation Upgrade past the affected range: - `python 3.7.1`