Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
method would not "pause" writing and signal to the Protocol to drain
the buffer to the wire once the write buffer reached the "high-water
mark". Because of this, Protocols would not periodically drain the write
buffer potentially leading to memory exhaustion.
This
vulnerability likely impacts a small number of users, you must be using
Python 3.12.0 or later, on macOS or Linux, using the asyncio module
with protocols, and using .writelines() method which had new
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of
these factors are true then your usage of Python is unaffected.
References
Configurations
No configuration.
History
No history.
Information
Published : 2024-12-06 16:15
Updated : 2025-04-04 23:15
NVD link : CVE-2024-12254
Mitre link : CVE-2024-12254
CVE.ORG link : CVE-2024-12254
JSON object : View
Products Affected
No product.