CVE-2024-12254

Unbounded memory buffering in SelectorSocketTransport.writelines()

CVE-2024-12254 is fixed in 30 products on 2 platforms, first by idle-python3.12 3.12.3-1ubuntu0.4, released December 6, 2024. 8 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
8.7
important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0187
79th percentile

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Python 3.12 3.12.9 Python 3.12 3.12.9 Feb 4, 2025
Python 3.13 3.13.2 Python 3.13 3.13.2 Feb 4, 2025
Linux
idle-python3.12 · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 idle-python3.12 3.12.3-1ubuntu0.4 Dec 6, 2024
idle-python3.12 · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 idle-python3.12 3.12.7-1ubuntu1.1 Jan 16, 2026
libpython3.12-minimal · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 libpython3.12-minimal 3.12.3-1ubuntu0.4 Dec 6, 2024
libpython3.12-minimal · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 libpython3.12-minimal 3.12.7-1ubuntu1.1 Jan 16, 2026
libpython3.12-stdlib · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 libpython3.12-stdlib 3.12.3-1ubuntu0.4 Dec 6, 2024
libpython3.12-stdlib · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 libpython3.12-stdlib 3.12.7-1ubuntu1.1 Jan 16, 2026
libpython3.12-testsuite · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 libpython3.12-testsuite 3.12.3-1ubuntu0.4 Dec 6, 2024
libpython3.12-testsuite · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 libpython3.12-testsuite 3.12.7-1ubuntu1.1 Jan 16, 2026
libpython3.12t64 · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 libpython3.12t64 3.12.3-1ubuntu0.4 Dec 6, 2024
libpython3.12t64 · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 libpython3.12t64 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12 · RHEL 10 3.12.9-1.el10 RHBA-2025:6294 Jan 31, 2025
python3.12 · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12 · RHEL 9 0:3.12.5-2.el9_5.2 RHSA-2024:10978 Dec 12, 2024
python3.12 · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 python3.12 3.12.3-1ubuntu0.4 Dec 6, 2024
python3.12 · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12 · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12 · almalinux 9 3.12.5-2.el9_5.2 ALSA-2024:10978 Dec 12, 2024
python3.12 · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12 · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12 · ol 9 0:3.12.5-2.el9_5.2 ELSA-2024-10978 Dec 12, 2024
python3.12 · rocky 8 0:3.12.8-1.el8_10 RLSA-2024:10980 Dec 19, 2024
python3.12 · rocky 9 0:3.12.5-2.el9_5.2 RLSA-2024:10978 Mar 17, 2025
python3.12-debug · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12-debug · RHEL 9 0:3.12.5-2.el9_5.2 RHSA-2024:10978 Dec 12, 2024
python3.12-debug · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12-debug · almalinux 9 3.12.5-2.el9_5.2 ALSA-2024:10978 Dec 12, 2024
python3.12-debug · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-debug · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12-debug · ol 9 0:3.12.5-2.el9_5.2 ELSA-2024-10978 Dec 12, 2024
python3.12-debuginfo · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-debugsource · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-devel · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12-devel · RHEL 9 0:3.12.5-2.el9_5.2 RHSA-2024:10978 Dec 12, 2024
python3.12-devel · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12-devel · almalinux 9 3.12.5-2.el9_5.2 ALSA-2024:10978 Dec 12, 2024
python3.12-devel · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-devel · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12-devel · ol 9 0:3.12.5-2.el9_5.2 ELSA-2024-10978 Dec 12, 2024
python3.12-examples · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 python3.12-examples 3.12.3-1ubuntu0.4 Dec 6, 2024
python3.12-examples · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12-examples 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12-full · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 python3.12-full 3.12.3-1ubuntu0.4 Dec 6, 2024
python3.12-full · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12-full 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12-gdbm · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12-gdbm 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12-idle · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12-idle · RHEL 9 0:3.12.5-2.el9_5.2 RHSA-2024:10978 Dec 12, 2024
python3.12-idle · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12-idle · almalinux 9 3.12.5-2.el9_5.2 ALSA-2024:10978 Dec 12, 2024
python3.12-idle · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-idle · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12-idle · ol 9 0:3.12.5-2.el9_5.2 ELSA-2024-10978 Dec 12, 2024
python3.12-libs · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12-libs · RHEL 9 0:3.12.5-2.el9_5.2 RHSA-2024:10978 Dec 12, 2024
python3.12-libs · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12-libs · almalinux 9 3.12.5-2.el9_5.2 ALSA-2024:10978 Dec 12, 2024
python3.12-libs · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-libs · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12-libs · ol 9 0:3.12.5-2.el9_5.2 ELSA-2024-10978 Dec 12, 2024
python3.12-minimal · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 python3.12-minimal 3.12.3-1ubuntu0.4 Dec 6, 2024
python3.12-minimal · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12-minimal 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12-nopie · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 python3.12-nopie 3.12.3-1ubuntu0.4 Dec 6, 2024
python3.12-nopie · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12-nopie 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12-rpm-macros · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12-rpm-macros · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12-rpm-macros · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12-test · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12-test · RHEL 9 0:3.12.5-2.el9_5.2 RHSA-2024:10978 Dec 12, 2024
python3.12-test · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12-test · almalinux 9 3.12.5-2.el9_5.2 ALSA-2024:10978 Dec 12, 2024
python3.12-test · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-test · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12-test · ol 9 0:3.12.5-2.el9_5.2 ELSA-2024-10978 Dec 12, 2024
python3.12-tk · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12-tk 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.12-tkinter · RHEL 8 0:3.12.8-1.el8_10 RHSA-2024:10980 Dec 12, 2024
python3.12-tkinter · RHEL 9 0:3.12.5-2.el9_5.2 RHSA-2024:10978 Dec 12, 2024
python3.12-tkinter · almalinux 8 3.12.8-1.el8_10 ALSA-2024:10980 Dec 12, 2024
python3.12-tkinter · almalinux 9 3.12.5-2.el9_5.2 ALSA-2024:10978 Dec 12, 2024
python3.12-tkinter · amzn 2023 3.12.8-1.amzn2023.0.1 ALAS2023-2025-808 Jan 21, 2025
python3.12-tkinter · ol 8 0:3.12.8-1.el8_10 ELSA-2024-10980 Dec 12, 2024
python3.12-tkinter · ol 9 0:3.12.5-2.el9_5.2 ELSA-2024-10978 Dec 12, 2024
python3.12-venv · Ubuntu 24.04.5 LTS (noble) 3.12.3-1ubuntu0.4 python3.12-venv 3.12.3-1ubuntu0.4 Dec 6, 2024
python3.12-venv · Ubuntu 24.10 (oracular) 3.12.7-1ubuntu1.1 python3.12-venv 3.12.7-1ubuntu1.1 Jan 16, 2026
python3.13 · Debian 13.5 (trixie) 3.13.1-2 DEBIAN-CVE-2024-12254 Dec 6, 2024
python312 · opensuse-leap 15.6 3.12.9-150600.3.18.1 SUSE-SU-2025:0521-1 Feb 13, 2025
python312 · sles 15.6 3.12.9-150600.3.18.1 SUSE-SU-2025:0521-1 Feb 13, 2025
python312-core · opensuse-leap 15.6 3.12.9-150600.3.18.1 SUSE-SU-2025:0521-1 Feb 13, 2025
python312-core · sles 15.6 3.12.9-150600.3.18.1 SUSE-SU-2025:0521-1 Feb 13, 2025
python312-documentation · opensuse-leap 15.6 3.12.9-150600.3.18.1 SUSE-SU-2025:0521-1 Feb 13, 2025
python313 · sles 15.7 3.13.5-150700.4.11.1 SUSE-SU-2025:02074-1 Jun 24, 2025
python313-core · sles 15.7 3.13.5-150700.4.11.1 SUSE-SU-2025:02074-1 Jun 24, 2025
No fix yet
Python 2 (Windows apps) No fix yet no-fix n/a
Python 3.10 (Windows apps) No fix yet no-fix n/a
Python 3.11 (Windows apps) No fix yet no-fix n/a
Python 3.5 (Windows apps) No fix yet no-fix n/a
Python 3.6 (Windows apps) No fix yet no-fix n/a
Python 3.7 (Windows apps) No fix yet no-fix n/a
Python 3.8 (Windows apps) No fix yet no-fix n/a
Python 3.9 (Windows apps) No fix yet no-fix n/a

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.