CVE-2025-13836: Content-Length Confusion Leads to Potential DoS

Overview

CVE-2025-13836 describes a vulnerability affecting HTTP clients where a malicious server can trigger a denial-of-service (DoS) attack by exploiting the way the client handles the Content-Length header. Specifically, if the client doesn’t specify a read amount when receiving an HTTP response, it defaults to using the value provided in the Content-Length header. A malicious server can send a very large Content-Length, forcing the client to allocate a large amount of memory, potentially leading to memory exhaustion (OOM) and a DoS condition.

Technical Details

The core of the vulnerability lies in the client’s reliance on the Content-Length header without proper size limits or validation. When reading an HTTP response, the client’s HTTP library attempts to read the number of bytes specified in the Content-Length header. A malicious server exploits this by providing an extremely large value for Content-Length, far exceeding the actual data being sent (or even sending no data after the headers). This forces the client to allocate a buffer of that size. Repeated or large allocations can lead to out-of-memory errors, effectively denying service to legitimate users.

CVSS Analysis

Currently, a CVSS score is not available (N/A) for CVE-2025-13836. However, the severity is considered N/A based on the available information. A CVSS score and updated severity assessment will be needed once it is officially calculated to determine the exact impact of the vulnerability.

Possible Impact

The primary impact of CVE-2025-13836 is a denial-of-service (DoS). An attacker can exploit this vulnerability to:

• Cause Memory Exhaustion (OOM): By forcing the client to allocate a large amount of memory, the attacker can cause the client application to crash due to an out-of-memory error.
• Disrupt Service: The DoS can disrupt the availability of the client application or service, making it unavailable to legitimate users.
• Impact Systems Reliant on the Client: Systems that rely on the vulnerable client for critical operations could be affected.

Mitigation or Patch Steps

To mitigate CVE-2025-13836, the following steps are recommended:

• Apply Patches: Apply the latest security patches released by the developers of the affected HTTP client libraries. Refer to the references below for patches related to the Python cpython library.
• Implement Size Limits: Implement maximum size limits on the Content-Length header that the client will accept. Any response exceeding this limit should be rejected.
• Validate Content-Length: Verify that the amount of data received matches the Content-Length header. If there is a discrepancy, close the connection.
• Implement Timeout: Implementing a timeout mechanism for HTTP reads can prevent the client from waiting indefinitely for data.

References

Python cpython Issue #119451
Python cpython Pull Request #119454