This vulnerability arises from CPython's HTTP response handling where, if no explicit read amount is specified, the client uses the Content-Length header to determine how much data to read. A malicious server can specify a large Content-Length value, causing the client to allocate and read large amounts of data into memory. This can result in resource exhaustion, specifically out-of-memory conditions or denial of service. The issue affects CPython versions 0, 3.11.0, 3.12.0, 3.13.0, 3.14.0, and 3.15.0a1. The CVSS 4.0 base score is 6.3, indicating medium severity. No patch or vendor advisory detailing remediation is currently provided.

An attacker controlling a malicious HTTP server can cause a CPython client to consume excessive memory by specifying a large Content-Length header in the HTTP response. This can lead to out-of-memory conditions or denial of service on the client system. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a patch is available, users should consider limiting exposure to untrusted HTTP servers or implementing application-level safeguards to restrict memory usage when processing HTTP responses.