CVE catalog
CVE-2024-12254
Python vulnerability
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.87% · Oct 25, 2026
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python3.11 | bookworm | 3.11.2-6+deb12u8 | not affected |
| Debian | python3.11 | bookworm-security | 3.11.2-6+deb12u9 | not affected |
| Ubuntu | python3.11 | noble | Not reported | not affected |
| Ubuntu | python3.12 | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | idle-python3.12 | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | libpython3.12-dev | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | libpython3.12-minimal | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | libpython3.12-stdlib | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | libpython3.12-testsuite | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | libpython3.12t64 | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12-dev | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12-doc | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12-examples | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12-full | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12-minimal | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12-nopie | noble | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12-venv | noble | 3.12.3-1ubuntu0.4 | fixed |
| Alpine | python3 | 3.20 | 3.12.8-r1 | fixed |
| Alpine | python3 | 3.21 | 3.12.8-r1 | fixed |
| Alpine | python3 | 3.22 | 3.12.8-r1 | fixed |
| Alpine | python3 | 3.23 | 3.12.8-r1 | fixed |
| Alpine | python3 | 3.24 | 3.12.8-r1 | fixed |
| Ubuntu | python3.12 | 24.04 | 3.12.0-1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.0-5 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.0-6 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.0-7 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.1-2 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-4build3 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-4build4 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-5ubuntu3 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.2 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.3 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.4 | fixed |
| Ubuntu | python3.12 | 24.04 | 3.12.0-1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.0-5 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.0-6 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.0-7 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.1-2 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-4build3 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-4build4 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.2-5ubuntu3 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.1 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.2 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.3 | vulnerable |
| Ubuntu | python3.12 | 24.04 | 3.12.3-1ubuntu0.4 | fixed |
| Opensuse | python313 | tumbleweed | 3.13.1-1.1 | fixed |
| Opensuse | python-aiohttp | tumbleweed | 3.11.16-1.1 | fixed |
| Suse | python312 | linux enterprise module for python 3 15 sp6 | 3.12.8-150600.3.12.1 | fixed |
| Suse | python312-core | linux enterprise module for python 3 15 sp6 | 3.12.8-150600.3.12.1 | fixed |
| Opensuse | python312 | leap 15.6 | 3.12.8-150600.3.12.1 | fixed |
| Opensuse | python312-core | leap 15.6 | 3.12.8-150600.3.12.1 | fixed |
| Opensuse | python312-documentation | leap 15.6 | 3.12.8-150600.3.12.1 | fixed |
| Opensuse | python312 | tumbleweed | 3.12.8-1.1 | fixed |
| Suse | python313 | linux enterprise module for python 3 15 sp7 | 3.13.5-150700.4.11.1 | fixed |
| Suse | python313-core | linux enterprise module for python 3 15 sp7 | 3.13.5-150700.4.11.1 | fixed |
| Suse | python312 | linux enterprise module for python 3 15 sp6 | 3.12.9-150600.3.18.1 | fixed |
| Suse | python312-core | linux enterprise module for python 3 15 sp6 | 3.12.9-150600.3.18.1 | fixed |
| Opensuse | python312 | leap 15.6 | 3.12.9-150600.3.18.1 | fixed |
| Opensuse | python312-core | leap 15.6 | 3.12.9-150600.3.18.1 | fixed |
| Opensuse | python312-documentation | leap 15.6 | 3.12.9-150600.3.18.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python3.11 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Ubuntu | python3.12 | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | idle-python3.12 | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | libpython3.12-dev | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | libpython3.12-minimal | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | libpython3.12-stdlib | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | libpython3.12-testsuite | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | libpython3.12t64 | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | python3.12-dev | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | python3.12-doc | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | python3.12-examples | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | python3.12-full | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | python3.12-minimal | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | python3.12-nopie | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | python3.12-venv | deb | noble | 3.12.3-1ubuntu0.4 | Not reported | Not reported | Not reported |
| Alpine | python3 | apk | 3.20 | 3.12.8-r1 | Not reported | ALPINE-CVE-2024-12254 | Not reported |
| Alpine | python3 | apk | 3.21 | 3.12.8-r1 | Not reported | ALPINE-CVE-2024-12254 | Not reported |
| Alpine | python3 | apk | 3.22 | 3.12.8-r1 | Not reported | ALPINE-CVE-2024-12254 | Not reported |
| Alpine | python3 | apk | 3.23 | 3.12.8-r1 | Not reported | ALPINE-CVE-2024-12254 | Not reported |
| Alpine | python3 | apk | 3.24 | 3.12.8-r1 | Not reported | ALPINE-CVE-2024-12254 | Not reported |
| Ubuntu | python3.12 | deb | 24.04 | 3.12.3-1ubuntu0.4 | Not reported | UBUNTU-CVE-2024-12254 | Not reported |
| Ubuntu | python3.12 | deb | 24.04 | 3.12.3-1ubuntu0.4 | Not reported | USN-7219-1 | Not reported |
| Opensuse | python313 | rpm | tumbleweed | 3.13.1-1.1 | Not reported | OPENSUSE-SU-2025:14691-1 | Not reported |
| Opensuse | python-aiohttp | rpm | tumbleweed | 3.11.16-1.1 | Not reported | OPENSUSE-SU-2025:14998-1 | Not reported |
| Suse | python312 | rpm | linux enterprise module for python 3 15 sp6 | 3.12.8-150600.3.12.1 | Not reported | SUSE-SU-2024:4291-1 | Not reported |
| Suse | python312-core | rpm | linux enterprise module for python 3 15 sp6 | 3.12.8-150600.3.12.1 | Not reported | SUSE-SU-2024:4291-1 | Not reported |
| Opensuse | python312 | rpm | leap 15.6 | 3.12.8-150600.3.12.1 | Not reported | SUSE-SU-2024:4291-1 | Not reported |
| Opensuse | python312-core | rpm | leap 15.6 | 3.12.8-150600.3.12.1 | Not reported | SUSE-SU-2024:4291-1 | Not reported |
| Opensuse | python312-documentation | rpm | leap 15.6 | 3.12.8-150600.3.12.1 | Not reported | SUSE-SU-2024:4291-1 | Not reported |
| Opensuse | python312 | rpm | tumbleweed | 3.12.8-1.1 | Not reported | OPENSUSE-SU-2024:14581-1 | Not reported |
| Suse | python313 | rpm | linux enterprise module for python 3 15 sp7 | 3.13.5-150700.4.11.1 | Not reported | SUSE-SU-2025:02074-1 | Not reported |
| Suse | python313-core | rpm | linux enterprise module for python 3 15 sp7 | 3.13.5-150700.4.11.1 | Not reported | SUSE-SU-2025:02074-1 | Not reported |
| Suse | python312 | rpm | linux enterprise module for python 3 15 sp6 | 3.12.9-150600.3.18.1 | Not reported | SUSE-SU-2025:0521-1 | Not reported |
| Suse | python312-core | rpm | linux enterprise module for python 3 15 sp6 | 3.12.9-150600.3.18.1 | Not reported | SUSE-SU-2025:0521-1 | Not reported |
| Opensuse | python312 | rpm | leap 15.6 | 3.12.9-150600.3.18.1 | Not reported | SUSE-SU-2025:0521-1 | Not reported |
| Opensuse | python312-core | rpm | leap 15.6 | 3.12.9-150600.3.18.1 | Not reported | SUSE-SU-2025:0521-1 | Not reported |
| Opensuse | python312-documentation | rpm | leap 15.6 | 3.12.9-150600.3.18.1 | Not reported | SUSE-SU-2025:0521-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [python312-32bit]Unknown
Source package: [python312]
Details (1)
3.12.13-9.1· x86_64 · tumbleweedUnknown · Fixed:
3.12.8-1.1Version impact unknown
usn · python312 · opensuse · tumbleweed
- [python312-curses]Unknown
Source package: [python312]
Details (1)
3.12.13-9.1· x86_64 · tumbleweedUnknown · Fixed:
3.12.8-1.1Version impact unknown
usn · python312 · opensuse · tumbleweed
- [python312-dbm]Unknown
Source package: [python312]
Details (1)
3.12.13-9.1· x86_64 · tumbleweedUnknown · Fixed:
3.12.8-1.1Version impact unknown
usn · python312 · opensuse · tumbleweed
- [python312-idle]Unknown
Source package: [python312]
Details (1)
3.12.13-9.1· x86_64 · tumbleweedUnknown · Fixed:
3.12.8-1.1Version impact unknown
usn · python312 · opensuse · tumbleweed
- [python312-tk]Unknown
Source package: [python312]
Details (1)
3.12.13-9.1· x86_64 · tumbleweedUnknown · Fixed:
3.12.8-1.1Version impact unknown
usn · python312 · opensuse · tumbleweed
- [python312-x86-64-v3]Unknown
Source package: [python312]
Details (1)
3.12.13-9.1· x86_64 · tumbleweedUnknown · Fixed:
3.12.8-1.1Version impact unknown
usn · python312 · opensuse · tumbleweed
- [python313-32bit]Unknown
Source package: [python313]
Details (1)
3.13.14-2.1· x86_64 · tumbleweedUnknown · Fixed:
3.13.1-1.1Version impact unknown
usn · python313 · opensuse · tumbleweed
- [python313-aiohttp]Unknown
Source package: [python-aiohttp]
Details (1)
3.14.3-1.1· x86_64 · tumbleweedUnknown · Fixed:
3.11.16-1.1Version impact unknown
usn · python-aiohttp · opensuse · tumbleweed
- [python313-curses]Unknown
Source package: [python313]
Details (1)
3.13.14-2.1· x86_64 · tumbleweedUnknown · Fixed:
3.13.1-1.1Version impact unknown
usn · python313 · opensuse · tumbleweed
- [python313-dbm]Unknown
Source package: [python313]
Details (1)
3.13.14-2.1· x86_64 · tumbleweedUnknown · Fixed:
3.13.1-1.1Version impact unknown
usn · python313 · opensuse · tumbleweed
- [python313-idle]Unknown
Source package: [python313]
Details (1)
3.13.14-2.1· x86_64 · tumbleweedUnknown · Fixed:
3.13.1-1.1Version impact unknown
usn · python313 · opensuse · tumbleweed
- [python313-tk]Unknown
Source package: [python313]
Details (1)
3.13.14-2.1· x86_64 · tumbleweedUnknown · Fixed:
3.13.1-1.1Version impact unknown
usn · python313 · opensuse · tumbleweed
- [python313-x86-64-v3]Unknown
Source package: [python313]
Details (1)
3.13.14-2.1· x86_64 · tumbleweedUnknown · Fixed:
3.13.1-1.1Version impact unknown
usn · python313 · opensuse · tumbleweed
- [python314-aiohttp]Unknown
Source package: [python-aiohttp]
Details (1)
3.14.3-1.1· x86_64 · tumbleweedUnknown · Fixed:
3.11.16-1.1Version impact unknown
usn · python-aiohttp · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [idle-python3.11]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· all · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u8· all · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· all · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
- [libpython3.11]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
- [libpython3.11-dbg]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
- [libpython3.11-dev]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
- [libpython3.11-minimal]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
- [libpython3.11-stdlib]Not affected
Source package: [python3.11]
Details (4)
3.11.2-6+deb12u8· amd64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u8· arm64 · bookwormNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· amd64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
3.11.2-6+deb12u3· arm64 · bookworm-securityNot affected
usn · python3.11 · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_10980.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2024-12254]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-12254]
- [https://osv.dev/vulnerability/SUSE-SU-2024:4291-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:02074-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:0521-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-12254]
- [https://osv.dev/vulnerability/USN-7219-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14581-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14691-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14998-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-12254]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12254.json]
- [https://ubuntu.com/security/notices/USN-7219-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3630.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]