Security fix for CVE-2025-13836

python3.12.spec

@@ -17,7 +17,7 @@ URL: https://www.python.org/
 #global prerel ...
 %global upstream_version %{general_version}%{?prerel}
 Version: %{general_version}%{?prerel:~%{prerel}}
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Python-2.0.1
 
 
@@ -421,6 +421,20 @@ Patch464: 00464-enable-pac-and-bti-protections-for-aarch64.patch
 # * gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
 Patch471: 00471-cve-2025-12084.patch
 
+# 00472 # 2ba215eaba508b2cdd7c3acfdf3b9a6e32872274
+# CVE-2025-13836
+#
+# [3.12] gh-119451: Fix a potential denial of service in http.client (GH-119454) (#142140)
+#
+# gh-119451: Fix a potential denial of service in http.client (GH-119454)
+#
+# Reading the whole body of the HTTP response could cause OOM if
+# the Content-Length value is too large even if the server does not send
+# a large amount of data. Now the HTTP client reads large data by chunks,
+# therefore the amount of consumed memory is proportional to the amount
+# of sent data.
+Patch472: 00472-cve-2025-13836.patch
+
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -1753,6 +1767,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Fri Jan 16 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-3
+- Security fix for CVE-2025-13836
+
 * Tue Jan 06 2026 Lumír Balhar <lbalhar@redhat.com> - 3.12.12-2
 - Security fix for CVE-2025-12084
 - Require at least the same expat version as used during the build time