CVE-2024-12254
highpriority · track · 1EPSS 0.019 · 79 %ileDEEURUUSEPSS · scored 2026-10-24
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (30)
Products and version ranges known to be affected.
- NetApp ActiveIQ Unified Manager for Microsoft Windowsall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-3630Python: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-12-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-libpython-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()2025-08-11vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
- BIT-python-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()2025-02-06vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
- BIT-python-min-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()2025-02-06vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
- PSF-2024-142024-12-06vendor · osvUS
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
also known as (8)
Other names and identifiers for this entity.
- CNNVD-202412-639cnnvd
- EUVD-2024-50718enisa_euvd
- BDU:2025-00345fstec_bdu
- GHSA-ph84-rcj2-fxxmenisa_euvd
- BIT-libpython-2024-12254osv
- BIT-python-2024-12254osv
- BIT-python-min-2024-12254osv
- PSF-2024-14osv
sources
Which sources assert this record, and when.
references (23)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2024/12/06/1cnnvd
- https://access.redhat.com/security/cve/cve-2024-12254cnnvd
- https://github.com/python/cpythonPatchcnnvd
- https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82cnnvd
- https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5cnnvd
- https://github.com/python/cpython/issues/127655cnnvd
- https://github.com/python/cpython/pull/127656cnnvd
- https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan