CVE-2025-13837Medium· 5.5▾ SunlitWhen loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
python < 3.13.10python >= 3.14.0, < 3.14.1python = 3.15.0Upgrade past the affected range:
python 3.14.1Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3737High· 7.5A flaw was found in python
CVE-2021-3733Medium· 6.5There's a flaw in urllib's AbstractBasicAuthHandler class
CVE-2019-9674High· 7.5Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
CVE-2020-8492Medium· 6.5Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.A…
CVE-2025-13836High· 7.5When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length
CVE-2025-6075Medium· 5.5If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.