CVE-2024-12254: CWE-400 Uncontrolled Resource Consumption in Python Software Foundation CPython
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
AI Analysis
Technical Summary
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method fails to pause writing and signal the Protocol to drain the write buffer once it reaches the high-water mark. This behavior change, related to the new zero-copy-on-write implementation of writelines(), can cause the write buffer to grow unchecked, potentially leading to memory exhaustion. This vulnerability affects Python versions 3.12.0 and later on macOS and Linux platforms when using asyncio protocols with the writelines() method. The affected versions include all releases before 3.12.9, exactly 3.13.0, versions from 3.13.0 up to but not including 3.13.2, and 3.14.0a1. There is no vendor advisory indicating an official fix or patch availability at this time.
Potential Impact
The vulnerability can cause uncontrolled resource consumption resulting in memory exhaustion in affected Python applications using asyncio protocols with the writelines() method. This may degrade application performance or cause crashes due to excessive memory use. The impact is limited to specific usage patterns and platforms (macOS and Linux) and does not affect all Python users.
Mitigation Recommendations
Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should avoid using the asyncio._SelectorSocketTransport.writelines() method in Python 3.12.0 and later on macOS or Linux with protocols, or implement application-level controls to manage write buffer usage. Monitor official Python channels for updates and patches addressing this issue.
CVE-2024-12254: CWE-400 Uncontrolled Resource Consumption in Python Software Foundation CPython
Description
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method fails to pause writing and signal the Protocol to drain the write buffer once it reaches the high-water mark. This behavior change, related to the new zero-copy-on-write implementation of writelines(), can cause the write buffer to grow unchecked, potentially leading to memory exhaustion. This vulnerability affects Python versions 3.12.0 and later on macOS and Linux platforms when using asyncio protocols with the writelines() method. The affected versions include all releases before 3.12.9, exactly 3.13.0, versions from 3.13.0 up to but not including 3.13.2, and 3.14.0a1. There is no vendor advisory indicating an official fix or patch availability at this time.
Potential Impact
The vulnerability can cause uncontrolled resource consumption resulting in memory exhaustion in affected Python applications using asyncio protocols with the writelines() method. This may degrade application performance or cause crashes due to excessive memory use. The impact is limited to specific usage patterns and platforms (macOS and Linux) and does not affect all Python users.
Mitigation Recommendations
Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should avoid using the asyncio._SelectorSocketTransport.writelines() method in Python 3.12.0 and later on macOS or Linux with protocols, or implement application-level controls to manage write buffer usage. Monitor official Python channels for updates and patches addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PSF
- Date Reserved
- 2024-12-05T16:17:55.154Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6cb6cfb597da70a83e0201
Added to database: 07/31/2026, 14:53:03 UTC
Last enriched: 07/31/2026, 15:07:09 UTC
Last updated: 09/14/2026, 22:01:25 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.