CVE-2025-12084
published 2025-12-03CVE-2025-12084: When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.71%
49.3th percentile
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jython | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | pypy3 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python2.7 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.11 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.13 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.14 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.9 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| msrc | azl3_python3_3.12.9-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.9-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_rsync_3.2.7-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rsync_3.4.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python3_3.9.19-17_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-18_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-19_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rsync_3.2.5-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rsync_3.4.1-1_on_cbl_mariner_2.0 | — | — |
| python | python | < 3.13.11 | 3.13.11 |
| python | python | — | — |
| python | python | >= 3.14.0 < 3.14.2 | 3.14.2 |
| python_software_foundation | cpython | < 3.10.20 | 3.10.20 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.15 | 3.11.15 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.13 | 3.12.13 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.11 | 3.13.11 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.2 | 3.14.2 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.3MEDIUM
vendor_msrc9.8CRITICAL
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python 2.7 vulnerabilities
vendor_ubuntu·2026-03-19·CVSS 5.3
CVE-2025-12084 [MEDIUM] Python 2.7 vulnerabilities
Title: Python 2.7 vulnerabilities
Summary: Several security issues were fixed in python2.7
USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672,
CVE-2026-0865 for python3. This update provides the corresponding updates
for python2.7.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
python3.13, and python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker
could possibly use this issue to cause a denial of service
Ubuntu
Python regression
vendor_ubuntu·2026-03-09·CVSS 5.3
CVE-2025-15367 [MEDIUM] Python regression
Title: Python regression
Summary: USN-8018-1 introduced a regression in Python
USN-8018-1 fixed vulnerabilities in python3. That update introduced
regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused
behavior regressions in IMAP and POP3 handling, which upstream chose to
avoid by not backporting them. Additionally, the patch for CVE-2026-0865
incorrectly rejected horizontal tabs in wsgiref headers. This update fixes
these problems.
We apologize for the inconvenience.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
pytho
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-02-05·CVSS 5.3
CVE-2025-15366 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6, python3.7,
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and
python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue to cause Python to use excessive
resources, leading to
Microsoft
Quadratic complexity in node ID cache clearing
vendor_msrc·2025-12-09·CVSS 5.3
CVE-2025-12084 [MEDIUM] CWE-407 Quadratic complexity in node ID cache clearing
Quadratic complexity in node ID cache clearing
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Red Hat
cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
vendor_redhat·2025-12-03·CVSS 6.3
CVE-2025-12084 [MEDIUM] CWE-770 cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
A flaw was found in cpython. This vulnerability allows impacted availability via a quadratic algorithm in `xml.dom.minidom` methods, such as `appendChild()`, when building excessively nested documents due to a dependency on `_clear_id_cache()`
Statement: This vulnerability is rated Important for Red Hat products as it can lead to a denial of service. The flaw exists in the `xml.dom.minidom` module of cpython, where a quadratic algorithm in methods like `appendChild()` can b
Microsoft
Rsync: heap buffer overflow in rsync due to improper checksum length handling
vendor_msrc·2025-01-14·CVSS 9.8
CVE-2024-12084 [CRITICAL] CWE-122 Rsync: heap buffer overflow in rsync due to improper checksum length handling
Rsync: heap buffer overflow in rsync due to improper checksum length handling
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Debian
CVE-2025-12084: jython - When building nested elements using xml.dom.minidom methods such as appendChild(...
vendor_debian·2025·CVSS 6.3
CVE-2025-12084 [MEDIUM] CVE-2025-12084: jython - When building nested elements using xml.dom.minidom methods such as appendChild(...
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
python2.7 vulnerabilities
osv·2026-03-19·CVSS 5.7
CVE-2025-12084 [MEDIUM] python2.7 vulnerabilities
python2.7 vulnerabilities
USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672,
CVE-2026-0865 for python3. This update provides the corresponding updates
for python2.7.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
python3.13, and python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2025-12084)
It was discovered that Python incorrectly pars
OSV
python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
osv·2026-03-09·CVSS 5.7
CVE-2025-15366 [MEDIUM] python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
USN-8018-1 fixed vulnerabilities in python3. That update introduced
regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused
behavior regressions in IMAP and POP3 handling, which upstream chose to
avoid by not backporting them. Additionally, the patch for CVE-2026-0865
incorrectly rejected horizontal tabs in wsgiref headers. This update fixes
these problems.
We apologize for the inconvenience.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3
OSV
python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
osv·2026-02-05·CVSS 5.7
CVE-2025-11468 [MEDIUM] python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6, python3.7,
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and
python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue
GHSA
GHSA-hfqx-732w-xrrw: When building nested elements using xml
ghsa_unreviewed·2025-12-03
CVE-2025-12084 [MEDIUM] CWE-407 GHSA-hfqx-732w-xrrw: When building nested elements using xml
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
OSV
CVE-2025-12084: When building nested elements using xml
osv·2025-12-03·CVSS 6.3
CVE-2025-12084 [MEDIUM] CVE-2025-12084: When building nested elements using xml
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-12084 asahi-installer: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service [fedora-43]
bugzilla·2025-12-15·CVSS 5.3
CVE-2025-12084 [MEDIUM] CVE-2025-12084 asahi-installer: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service [fedora-43]
CVE-2025-12084 asahi-installer: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This CVE is in the CPython interpreter, fixed by the python3 update; this package only uses the affected stdlib module and needs no change of its own.
Bugzilla
CVE-2025-12084 asahi-installer: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service [fedora-42]
bugzilla·2025-12-15·CVSS 6.3
CVE-2025-12084 [MEDIUM] CVE-2025-12084 asahi-installer: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service [fedora-42]
CVE-2025-12084 asahi-installer: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fe
Bugzilla
CVE-2025-12084 cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
bugzilla·2025-12-03·CVSS 6.3
CVE-2025-12084 [MEDIUM] CVE-2025-12084 cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
CVE-2025-12084 cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:0123 https://access.redhat.com/errata/RHSA-2026:0123
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:1374 https://access.redhat.com/errata/RHSA-2026:1374
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:1408 https://access.redhat.com/er
https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436afhttps://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842dhttps://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53https://github.com/python/cpython/issues/142145https://github.com/python/cpython/pull/142146
2025-12-03
Published