{"schema_version":"1.8.0","id":"CVE-2020-10735","published":"2022-09-09T14:15:08.660Z","modified":"2026-08-07T11:31:00.045915254Z","aliases":["BIT-libpython-2020-10735","BIT-python-2020-10735","BIT-python-min-2020-10735","PSF-2022-4"],"related":["ALSA-2022:7323","ALSA-2023:0833","ALSA-2023:2763","ALSA-2023:2764","CGA-fr3r-p288-gqg5","SUSE-SU-2022:3473-1","SUSE-SU-2022:3485-1","SUSE-SU-2022:3924-1","SUSE-SU-2022:4251-1","SUSE-SU-2022:4274-1","SUSE-SU-2022:4281-1","openSUSE-SU-2024:12318-1","openSUSE-SU-2024:12336-1","openSUSE-SU-2024:12340-1","openSUSE-SU-2024:12341-1","openSUSE-SU-2024:12342-1","openSUSE-SU-2024:12910-1","openSUSE-SU-2024:14109-1","openSUSE-SU-2024:14434-1","openSUSE-SU-2025:14712-1","openSUSE-SU-2025:15713-1"],"details":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"1bf9cc509326bc42cd8cb1650eb9bf64550d817e"},{"fixed":"e1ebdc52b8bd82a928398b0a75149552a723389a"},{"introduced":"fa919fdf2583bdfead1df00e842f24f30b2a34bf"},{"fixed":"f43e7678a1443b2583fc9bfba091b8ca7e38f075"},{"introduced":"9cf6752276e6fcfd0c23fdb064ad27f448aaaf75"},{"fixed":"816066f497ab89abcdb3c4f2d34462c750d23713"},{"introduced":"b494f5935c92951e75597bfe1c8b1f3112fec270"},{"fixed":"6cc6b13308b3202270ea7ac0ee776762a66f6a2f"},{"introduced":"41cb07120b7792eac6413b0c56256a25e9b14e5d"},{"last_affected":"41cb07120b7792eac6413b0c56256a25e9b14e5d"}],"database_specific":{"cpe":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.7.0"},{"fixed":"3.7.14"},{"introduced":"3.8.0"},{"fixed":"3.8.14"},{"introduced":"3.9.0"},{"fixed":"3.9.14"},{"introduced":"3.10.0"},{"fixed":"3.10.7"},{"introduced":"3.11.0-rc1"},{"last_affected":"3.11.0-rc1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["3.11.0-rc1","v3.11.0rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10735.json"}}],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2022/09/21/1"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2022/09/21/4"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2020-10735"},{"type":"ADVISORY","url":"https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834423"},{"type":"FIX","url":"https://github.com/python/cpython/issues/95778"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"35"},{"last_affected":"35"},{"introduced":"36"},{"last_affected":"36"},{"introduced":"37"},{"last_affected":"37"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"},{"cpes":["cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:*","cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.11.0-alpha1"},{"last_affected":"3.11.0-alpha1"},{"introduced":"3.11.0-alpha2"},{"last_affected":"3.11.0-alpha2"},{"introduced":"3.11.0-alpha3"},{"last_affected":"3.11.0-alpha3"},{"introduced":"3.11.0-alpha4"},{"last_affected":"3.11.0-alpha4"},{"introduced":"3.11.0-alpha5"},{"last_affected":"3.11.0-alpha5"},{"introduced":"3.11.0-alpha6"},{"last_affected":"3.11.0-alpha6"},{"introduced":"3.11.0-alpha7"},{"last_affected":"3.11.0-alpha7"},{"introduced":"3.11.0-beta1"},{"last_affected":"3.11.0-beta1"},{"introduced":"3.11.0-beta2"},{"last_affected":"3.11.0-beta2"},{"introduced":"3.11.0-beta3"},{"last_affected":"3.11.0-beta3"},{"introduced":"3.11.0-beta4"},{"last_affected":"3.11.0-beta4"},{"introduced":"3.11.0-beta5"},{"last_affected":"3.11.0-beta5"}],"source":"CPE_STRING","vendor_product":"python:python"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux"},{"cpes":["cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.0"},{"last_affected":"3.0.0"}],"source":"CPE_STRING","vendor_product":"redhat:quay"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}