CVE-2025-13837 Out-of-memory when loading Plist
A malicious plist file can cause out-of-memory errors and denial of service in applications using Python's plistlib module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13837?
CVE-2025-13837 is a low-severity denial of service vulnerability in Python Python, published on 1 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
Weakness: CWE-400
Which versions are affected by CVE-2025-13837?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1 |
python Bitnami | All versions | 3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1 |
python-min Bitnami | All versions | 3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1 |
Products include Python Python.
How do I fix CVE-2025-13837?
Upgrade libpython to a fixed version for your release line: 3.10.20, 3.11.15, 3.12.13 or 3.13.10.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-13837 being exploited?
There is no known exploitation of CVE-2025-13837 in the wild and no public exploit code.
Other vulnerabilities in Python Python
Sources
Also known as AZL-109692, AZL-71267, AZL-71275, BELL-CVE-2025-13837, BIT-libpython-2025-13837, BIT-python-2025-13837 and 12 more.