Unbounded memory buffering in SelectorSocketTransport.writelines()
CVE-2024-12254 is fixed in 30 products on 2 platforms, first by idle-python3.12 3.12.3-1ubuntu0.4, released December 6, 2024. 8 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.12 | 3.12.9 | Python 3.12 3.12.9 | Feb 4, 2025 |
| Python 3.13 | 3.13.2 | Python 3.13 3.13.2 | Feb 4, 2025 |
| Linux | |||
| idle-python3.12 · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | idle-python3.12 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| idle-python3.12 · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | idle-python3.12 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| libpython3.12-minimal · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | libpython3.12-minimal 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| libpython3.12-minimal · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | libpython3.12-minimal 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| libpython3.12-stdlib · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | libpython3.12-stdlib 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| libpython3.12-stdlib · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | libpython3.12-stdlib 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| libpython3.12-testsuite · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | libpython3.12-testsuite 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| libpython3.12-testsuite · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | libpython3.12-testsuite 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| libpython3.12t64 · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | libpython3.12t64 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| libpython3.12t64 · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | libpython3.12t64 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12 · RHEL 10 | 3.12.9-1.el10 | RHBA-2025:6294 | Jan 31, 2025 |
| python3.12 · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12 · RHEL 9 | 0:3.12.5-2.el9_5.2 | RHSA-2024:10978 | Dec 12, 2024 |
| python3.12 · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | python3.12 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| python3.12 · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12 · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12 · almalinux 9 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 | Dec 12, 2024 |
| python3.12 · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12 · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12 · ol 9 | 0:3.12.5-2.el9_5.2 | ELSA-2024-10978 | Dec 12, 2024 |
| python3.12 · rocky 8 | 0:3.12.8-1.el8_10 | RLSA-2024:10980 | Dec 19, 2024 |
| python3.12 · rocky 9 | 0:3.12.5-2.el9_5.2 | RLSA-2024:10978 | Mar 17, 2025 |
| python3.12-debug · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12-debug · RHEL 9 | 0:3.12.5-2.el9_5.2 | RHSA-2024:10978 | Dec 12, 2024 |
| python3.12-debug · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12-debug · almalinux 9 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 | Dec 12, 2024 |
| python3.12-debug · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-debug · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12-debug · ol 9 | 0:3.12.5-2.el9_5.2 | ELSA-2024-10978 | Dec 12, 2024 |
| python3.12-debuginfo · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-debugsource · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-devel · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12-devel · RHEL 9 | 0:3.12.5-2.el9_5.2 | RHSA-2024:10978 | Dec 12, 2024 |
| python3.12-devel · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12-devel · almalinux 9 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 | Dec 12, 2024 |
| python3.12-devel · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-devel · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12-devel · ol 9 | 0:3.12.5-2.el9_5.2 | ELSA-2024-10978 | Dec 12, 2024 |
| python3.12-examples · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | python3.12-examples 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| python3.12-examples · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12-examples 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12-full · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | python3.12-full 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| python3.12-full · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12-full 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12-gdbm · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12-gdbm 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12-idle · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12-idle · RHEL 9 | 0:3.12.5-2.el9_5.2 | RHSA-2024:10978 | Dec 12, 2024 |
| python3.12-idle · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12-idle · almalinux 9 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 | Dec 12, 2024 |
| python3.12-idle · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-idle · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12-idle · ol 9 | 0:3.12.5-2.el9_5.2 | ELSA-2024-10978 | Dec 12, 2024 |
| python3.12-libs · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12-libs · RHEL 9 | 0:3.12.5-2.el9_5.2 | RHSA-2024:10978 | Dec 12, 2024 |
| python3.12-libs · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12-libs · almalinux 9 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 | Dec 12, 2024 |
| python3.12-libs · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-libs · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12-libs · ol 9 | 0:3.12.5-2.el9_5.2 | ELSA-2024-10978 | Dec 12, 2024 |
| python3.12-minimal · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | python3.12-minimal 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| python3.12-minimal · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12-minimal 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12-nopie · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | python3.12-nopie 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| python3.12-nopie · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12-nopie 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12-rpm-macros · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12-rpm-macros · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12-rpm-macros · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12-test · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12-test · RHEL 9 | 0:3.12.5-2.el9_5.2 | RHSA-2024:10978 | Dec 12, 2024 |
| python3.12-test · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12-test · almalinux 9 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 | Dec 12, 2024 |
| python3.12-test · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-test · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12-test · ol 9 | 0:3.12.5-2.el9_5.2 | ELSA-2024-10978 | Dec 12, 2024 |
| python3.12-tk · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12-tk 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.12-tkinter · RHEL 8 | 0:3.12.8-1.el8_10 | RHSA-2024:10980 | Dec 12, 2024 |
| python3.12-tkinter · RHEL 9 | 0:3.12.5-2.el9_5.2 | RHSA-2024:10978 | Dec 12, 2024 |
| python3.12-tkinter · almalinux 8 | 3.12.8-1.el8_10 | ALSA-2024:10980 | Dec 12, 2024 |
| python3.12-tkinter · almalinux 9 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 | Dec 12, 2024 |
| python3.12-tkinter · amzn 2023 | 3.12.8-1.amzn2023.0.1 | ALAS2023-2025-808 | Jan 21, 2025 |
| python3.12-tkinter · ol 8 | 0:3.12.8-1.el8_10 | ELSA-2024-10980 | Dec 12, 2024 |
| python3.12-tkinter · ol 9 | 0:3.12.5-2.el9_5.2 | ELSA-2024-10978 | Dec 12, 2024 |
| python3.12-venv · Ubuntu 24.04.5 LTS (noble) | 3.12.3-1ubuntu0.4 | python3.12-venv 3.12.3-1ubuntu0.4 | Dec 6, 2024 |
| python3.12-venv · Ubuntu 24.10 (oracular) | 3.12.7-1ubuntu1.1 | python3.12-venv 3.12.7-1ubuntu1.1 | Jan 16, 2026 |
| python3.13 · Debian 13.5 (trixie) | 3.13.1-2 | DEBIAN-CVE-2024-12254 | Dec 6, 2024 |
| python312 · opensuse-leap 15.6 | 3.12.9-150600.3.18.1 | SUSE-SU-2025:0521-1 | Feb 13, 2025 |
| python312 · sles 15.6 | 3.12.9-150600.3.18.1 | SUSE-SU-2025:0521-1 | Feb 13, 2025 |
| python312-core · opensuse-leap 15.6 | 3.12.9-150600.3.18.1 | SUSE-SU-2025:0521-1 | Feb 13, 2025 |
| python312-core · sles 15.6 | 3.12.9-150600.3.18.1 | SUSE-SU-2025:0521-1 | Feb 13, 2025 |
| python312-documentation · opensuse-leap 15.6 | 3.12.9-150600.3.18.1 | SUSE-SU-2025:0521-1 | Feb 13, 2025 |
| python313 · sles 15.7 | 3.13.5-150700.4.11.1 | SUSE-SU-2025:02074-1 | Jun 24, 2025 |
| python313-core · sles 15.7 | 3.13.5-150700.4.11.1 | SUSE-SU-2025:02074-1 | Jun 24, 2025 |
| No fix yet | |||
| Python 2 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.10 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.11 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.5 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.6 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.7 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.8 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.9 (Windows apps) | No fix yet | no-fix | n/a |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.