CVE-2020-10735 Denial of service in python

Medium 6.2 Published 9 Sep 2022 Updated 14 Oct 2026

Attackers can cause denial of service by submitting large integer strings to Python's int() function, leading to excessive CPU consumption.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2020-10735?

CVE-2020-10735 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 9 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Weakness: CWE-704

Which versions are affected by CVE-2020-10735?

3 open source packages ship an affected version, including libpython, python and python-min. It affects 5 products.

Package	Affected	Fixed in
`libpython` Bitnami	From `3.7.0`	`3.7.14, 3.8.14, 3.9.14, 3.10.7`
`python` Bitnami	From `3.7.0`	`3.7.14, 3.8.14, 3.9.14, 3.10.7`
`python-min` Bitnami	From `3.7.0`	`3.7.14, 3.8.14, 3.9.14, 3.10.7`

Linux distribution packages (29)

`python-unversioned-command` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python3` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python3-debug` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python3-devel` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python3-idle` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python3-libs` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python3-test` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python3-tkinter` AlmaLinux:9	All versions	`3.9.10-3.el9_0`
`python-unversioned-command` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.9.10-3.el9_0`
`python3-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.9.10-3.el9_0`
`python3-tkinter` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.9.10-3.el9_0`
`python3.9-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.9.10-3.el9_0`
`python3.9-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:3.9.10-3.el9_0`
`python3` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.9.10-3.el9_0`
`python3-libs` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.9.10-3.el9_0`
`python3.9` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.9.10-3.el9_0`
`python3.9-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.9.10-3.el9_0`
`python3.9-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:3.9.10-3.el9_0`
`python3` Red Hat:enterprise_linux:9::crb	All versions	`0:3.9.10-3.el9_0`
`python3-debug` Red Hat:enterprise_linux:9::crb	All versions	`0:3.9.10-3.el9_0`
`python3-idle` Red Hat:enterprise_linux:9::crb	All versions	`0:3.9.10-3.el9_0`
`python3-test` Red Hat:enterprise_linux:9::crb	All versions	`0:3.9.10-3.el9_0`
`python3-tkinter` Red Hat:enterprise_linux:9::crb	All versions	`0:3.9.10-3.el9_0`
`python3.9-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:3.9.10-3.el9_0`
`python3.9-debugsource` Red Hat:enterprise_linux:9::crb	All versions	`0:3.9.10-3.el9_0`
`python3.9` Rocky Linux:9	All versions	`0:3.9.10-3.el9_0`
`python-pydantic` openSUSE:Tumbleweed	All versions	`2.10.6-1.1`
`python310` openSUSE:Tumbleweed	All versions	`3.10.7-1.2`
`python39` openSUSE:Tumbleweed	All versions	`3.9.14-1.1`

Products include Fedoraproject Fedora, Python Python, Redhat Enterprise Linux, Redhat Quay, Redhat Software Collections.

How do I fix CVE-2020-10735?

Upgrade libpython to a fixed version for your release line: 3.7.14, 3.8.14, 3.9.14 or 3.10.7.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-10735 being exploited?

There is no known exploitation of CVE-2020-10735 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as ALSA-2022:7323, BIT-libpython-2020-10735, BIT-python-2020-10735, BIT-python-min-2020-10735, DEBIAN-CVE-2020-10735, GHSA-6jr7-xr67-mgxw and 9 more.