Open
Description
http.client.HTTPResponse.read() (without argument) consumes the amount of memory specified by the value of the Content-Lenght header in the response before starting receiving the data from the socket. Normally, if the server does not send enough data, the client gets IncompleteRead error, but if Content-Lenght is too large, it can consume a large amount of memory and CPU time and cause swapping. Therefore, a maleficent server can cause a DOS attack on client by sending a small response.
Linked PRs
Metadata
Metadata
Assignees
Labels
only security fixesonly security fixesonly security fixesonly security fixesonly security fixesonly security fixesbugs and security fixesbugs and security fixesbugs and security fixesbugs and security fixesend of lifeend of lifeonly security fixesonly security fixesPython modules in the Lib dirPython modules in the Lib dirA security issueA security issue