Inefficient algorithmic complexity in Python - CVE-2025-12084
Published: December 6, 2025
Vulnerability identifier: #VU119238
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-12084
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Python.org
Affected software:
Python
Python
Detailed vulnerability description
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to usage of a quadratic algorithm when building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache(). A remote attacker can force the application to create excessively nested documents, leading to a denial of service condition.
How to mitigate CVE-2025-12084
Install updates from vendor's website.
Sources
- https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0
- https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4
- https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964
- https://github.com/python/cpython/issues/142145
- https://github.com/python/cpython/pull/142146