CVE-2024-12254

A flaw was found in Python. In certain configurations, the asyncio._SelectorSocketTransport.writelines() method fails to signal the protocol to clear the write buffer when it approaches capacity. Because of this, protocols would not periodically drain the write buffer, potentially leading to a denial of service via memory exhaustion.

This vulnerability likely impacts a small number of users. You must be using Python 3.12.0 or later, on Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true, then your usage of Python is unaffected.

This vulnerability is rated with an Important severity due to its potential for denial of service (DoS) attacks through memory exhaustion. By failing to signal the protocol to drain the write buffer when approaching the high-water mark, the affected asyncio._SelectorSocketTransport.writelines() method introduces a important flaw in flow control. This flaw can lead to uncontrolled growth of the buffer in long-running or high-throughput applications, which are typical in networked systems or event-driven architectures. Given that asyncio is widely used in performance-critical Python applications for handling asynchronous I/O, the impact of memory exhaustion could destabilize services, compromise system availability, and increase the risk of cascading failures, especially in production environments handling large-scale or untrusted inputs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.