Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2024-12254

Unbounded memory buffering in SelectorSocketTransport.writelines()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
PSF

Description

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Python Software Foundation CPython

Default version status: unaffected

  • 0 to < 3.12.9affected
  • 3.13.0 to < 3.13.2affected
  • 3.14.0a1 to < 3.14.0a3affected

References