python -- several vulnerabilities

2025-12-08 · CVE-2025-12084, CVE-2025-13836 · VuXML entry

Hugo van Kemenade reports: Python 3.14.2 and 3.13.11 are now available [... and] come with some bonus security fixes. gh-142145: Remove quadratic behavior in node ID cache clearing (CVE-2025-12084) gh-119451: Fix a potential denial of service in http.client [only in 3.13; CVE-2025-13836] gh-119452: Fix a potential virtual memory allocation denial of service in http.server [affects platforms without fork()]

Affected versions

• python39 >= 0
• python310 < 3.10.19_1
• python311 < 3.11.14_1
• python312 < 3.12.12_3
• python313 < 3.13.11
• python314 < 3.14.2

By system

6 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.