CVE-2025-13837

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

• CVE-2025-13837: fix a potential denial of service in plistlib (GH-119343)

Excessive read buffering DoS in http.client. (CVE-2025-13836) Out-of-memory when loading Plist. (CVE-2025-13837) Quadratic complexity in node ID cache clearing. (CVE-2025-12084)

These are all security issues fixed in the python310-3.10.19-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.25-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.14-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.12-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python313 fixes the following issues:

• Update to 3.13.11:

• Security

  • CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
  • CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
  • CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)
  • CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) not checked by the 'zipfile' module (bsc#1251305)
  • gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser.
  • gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  • CVE-2025-6075: Fixed performance issues caused by user-controller os.path.expandvars() (bsc#1252974)

• Library

  • gh-140797: Revert changes to the undocumented re.Scanner class. Capturing groups are still allowed for backward compatibility, although using them can lead to incorrect result. They will be forbidden in future Python versions.
  • gh-142206: The resource tracker in the multiprocessing module now uses the original communication protocol, as in Python 3.14.0 and below, by default. This avoids issues with upgrading Python while it is running. (Note that such ‘in-place’ upgrades are not tested.) The tracker remains compatible with subprocesses that use new protocol (that is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).

• Core and Builtins

  • gh-142218: Fix crash when inserting into a split table dictionary with a non str key that matches an existing key.

• Update to 3.13.10:

• Tools/Demos

  • gh-141442: The iOS testbed now correctly handles test arguments that contain spaces.

• Tests

  • gh-140482: Preserve and restore the state of stty echo as part of the test environment.
  • gh-140082: Update python -m test to set FORCE_COLOR=1 when being run with color enabled so that unittest which is run by it with redirected output will output in color.
  • gh-136442: Use exitcode 1 instead of 5 if unittest.TestCase.setUpClass() raises an exception

• Library

  • gh-74389: When the stdin being used by a subprocess.Popen instance is closed, this is now ignored in subprocess.Popen.communicate() instead of leaving the class in an inconsistent state.
  • gh-87512: Fix subprocess.Popen.communicate() timeout handling on Windows when writing large input. Previously, the timeout was ignored during stdin writing, causing the method to block indefinitely if the child process did not consume input quickly. The stdin write is now performed in a background thread, allowing the timeout to be properly enforced.
  • gh-141473: When subprocess.Popen.communicate() was called with input and a timeout and is called for a second time after a TimeoutExpired exception before the process has died, it should no longer hang.
  • gh-59000: Fix pdb breakpoint resolution for class methods when the module defining the class is not imported.
  • gh-141570: Support file-like object raising OSError from fileno() in color detection (_colorize.can_colorize()). This can occur when sys.stdout is redirected.
  • gh-141659: Fix bad file descriptor errors from _posixsubprocess on AIX.
  • gh-141497: ipaddress: ensure that the methods IPv4Network.hosts() and IPv6Network.hosts() always return an iterator.
  • gh-140938: The statistics.stdev() and statistics.pstdev() functions now raise a ValueError when the input contains an infinity or a NaN.
  • gh-124111: Updated Tcl threading configuration in _tkinter to assume that threads are…

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Root has patched CVE-2025-13837 in the rootio-python3.11 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-13837 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available.

This update for python39 fixes the following issues:

• CVE-2025-12084: quadratic complexity when building nested elements using xml.dom.minidom methods that depend on _clear_id_cache() can lead to availability issues when building excessively nested documents (bsc#1254997).
• CVE-2025-13836: use of Content-Length by default when reading an HTTP response with no read amount specified can lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
• CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can lead to OOM issues and DoS (bsc#1254401).

This update for python3 fixes the following issues:

• CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
• CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
• CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)

This update for python36 fixes the following issues:

• CVE-2025-12084: quadratic complexity when building nested elements using xml.dom.minidom methods that depend on _clear_id_cache() can lead to availability issues when building excessively nested documents (bsc#1254997).
• CVE-2025-13836: use of Content-Length by default when reading an HTTP response with no read amount specified can lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
• CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can lead to OOM issues and DoS (bsc#1254401).

This update for python313 fixes the following issues:

Update to version 3.13.11.

Security issues fixed:

• CVE-2025-12084: quadratic complexity when building nested elements using xml.dom.minidom methods that depend on _clear_id_cache() can lead to availability issues when building excessively nested documents (bsc#1254997).
• CVE-2025-13836: use of Content-Length by default when reading an HTTP response with no read amount specified can lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
• CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can lead to OOM issues and DoS (bsc#1254401).

Other updates and bugfixes:

• Version 3.13.11:

  • Library
    • gh-140797: Revert changes to the undocumented re.Scanner class. Capturing groups are still allowed for backward compatibility, although using them can lead to incorrect result. They will be forbidden in future Python versions.
    • gh-142206: The resource tracker in the multiprocessing module now uses the original communication protocol, as in Python 3.14.0 and below, by default. This avoids issues with upgrading Python while it is running. (Note that such ‘in-place’ upgrades are not tested.) The tracker remains compatible with subprocesses that use new protocol (that is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).
  • Core and Builtins
    • gh-142218: Fix crash when inserting into a split table dictionary with a non str key that matches an existing key.

• Version to 3.13.10:

  • Security
    • gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser.
    • gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  • Library
    • gh-74389: When the stdin being used by a subprocess.Popen instance is closed, this is now ignored in subprocess.Popen.communicate() instead of leaving the class in an inconsistent state.
    • gh-87512: Fix subprocess.Popen.communicate() timeout handling on Windows when writing large input. Previously, the timeout was ignored during stdin writing, causing the method to block indefinitely if the child process did not consume input quickly. The stdin write is now performed in a background thread, allowing the timeout to be properly enforced.
    • gh-141473: When subprocess.Popen.communicate() was called with input and a timeout and is called for a second time after a TimeoutExpired exception before the process has died, it should no longer hang.
    • gh-59000: Fix pdb breakpoint resolution for class methods when the module defining the class is not imported.
    • gh-141570: Support file-like object raising OSError from fileno() in color detection (_colorize.can_colorize()). This can occur when sys.stdout is redirected.
    • gh-141659: Fix bad file descriptor errors from _posixsubprocess on AIX.
    • gh-141497: ipaddress: ensure that the methods IPv4Network.hosts() and IPv6Network.hosts() always return an iterator.
    • gh-140938: The statistics.stdev() and statistics.pstdev() functions now raise a ValueError when the input contains an infinity or a NaN.
    • gh-124111: Updated Tcl threading configuration in _tkinter to assume that threads are always available in Tcl 9 and later.
    • gh-137109: The os.fork and related forking APIs will no longer warn in the common case where Linux or macOS platform APIs return the number of threads in a process and find the answer to be 1 even when a os.register_at_fork() after_in_parent= callback (re)starts a thread.
    • gh-141314: Fix assertion failure in…

This update for python312 fixes the following issues:

• CVE-2025-12084: quadratic complexity when building nested elements using xml.dom.minidom methods that depend on _clear_id_cache() can lead to availability issues when building excessively nested documents (bsc#1254997).
• CVE-2025-13836: use of Content-Length by default when reading an HTTP response with no read amount specified can lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
• CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can lead to OOM issues and DoS (bsc#1254401).

This update for python3 fixes the following issues:

• CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
• CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
• CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)

This update for python310 fixes the following issues:

• CVE-2025-12084: quadratic complexity when building nested elements using xml.dom.minidom methods that depend on _clear_id_cache() can lead to availability issues when building excessively nested documents (bsc#1254997).
• CVE-2025-13836: use of Content-Length by default when reading an HTTP response with no read amount specified can lead to OOM issues and DoS when a client deals with a malicious server (bsc#1254400).
• CVE-2025-13837: data read by the plistlib module according to the size specified by the file itself can lead to OOM issues and DoS (bsc#1254401).