CVE-2025-6075
published 2025-10-31CVE-2025-6075: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
3.5th percentile
If the value passed to os.path.expandvars() is user-controlled a
performance degradation is possible when expanding environment
variables.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.11 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.13 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.14 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| debian | python3.9 | < python3.13 3.13.11-1 (forky) | python3.13 3.13.11-1 (forky) |
| msrc | azl3_python3_3.12.9-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.9-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python3_3.9.19-15_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-16_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-17_on_cbl_mariner_2.0 | — | — |
| python | python | < 3.9.0 | 3.9.0 |
| python | python | — | — |
| python | python | >= 3.13.1 < 3.13.11 | 3.13.11 |
| python | python | >= 3.14.0 < 3.14.1 | 3.14.1 |
| python_software_foundation | cpython | < 3.10.20 | 3.10.20 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.15 | 3.11.15 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.13 | 3.12.13 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.10 | 3.13.10 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.1 | 3.14.1 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0a2 | 3.15.0a2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.01.8LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv1.8LOW
vendor_ubuntu5.5MEDIUM
vendor_debian1.8LOW
vendor_msrc1.8LOW
vendor_redhat1.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python3.13 vulnerabilities
osv·2025-11-26·CVSS 1.8
CVE-2025-6075 [LOW] python3.13 vulnerabilities
python3.13 vulnerabilities
USN-7886-1 fixed vulnerabilities in Python. This update provides the
corresponding updates for python3.13 in Ubuntu 25.04 and Ubuntu 25.10.
Original advisory details:
It was discovered that Python inefficiently handled expanding system
environment variables. An attacker could possibly use this issue to cause
Python to consume excessive resources, leading to a denial of service.
(CVE-2025-6075)
Caleb Brown discovered that Python incorrectly handled the ZIP64 End of
Central Directory (EOCD) Locator record offset value. An attacker could
possibly use this issue to obfuscate malicious content. (CVE-2025-8291)
OSV
python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
osv·2025-11-24·CVSS 1.8
CVE-2025-6075 [LOW] python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
It was discovered that Python inefficiently handled expanding system
environment variables. An attacker could possibly use this issue to cause
Python to consume excessive resources, leading to a denial of service.
(CVE-2025-6075)
Caleb Brown discovered that Python incorrectly handled the ZIP64 End of
Central Directory (EOCD) Locator record offset value. An attacker could
possibly use this issue to obfuscate malicious content. (CVE-2025-8291)
OSV
CVE-2025-6075: If the value passed to os
osv·2025-10-31·CVSS 1.8
CVE-2025-6075 [LOW] CVE-2025-6075: If the value passed to os
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
GHSA
GHSA-vc2m-m665-8xm2: If the value passed to os
ghsa_unreviewed·2025-10-31
CVE-2025-6075 [LOW] CWE-400 GHSA-vc2m-m665-8xm2: If the value passed to os
If the value passed to os.path.expandvars() is user-controlled a
performance degradation is possible when expanding environment
variables.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2025-11-26·CVSS 5.5
CVE-2025-6075 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
USN-7886-1 fixed vulnerabilities in Python. This update provides the
corresponding updates for python3.13 in Ubuntu 25.04 and Ubuntu 25.10.
Original advisory details:
It was discovered that Python inefficiently handled expanding system
environment variables. An attacker could possibly use this issue to cause
Python to consume excessive resources, leading to a denial of service.
(CVE-2025-6075)
Caleb Brown discovered that Python incorrectly handled the ZIP64 End of
Central Directory (EOCD) Locator record offset value. An attacker could
possibly use this issue to obfuscate malicious content. (CVE-2025-8291)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.5
CVE-2025-6075 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python inefficiently handled expanding system
environment variables. An attacker could possibly use this issue to cause
Python to consume excessive resources, leading to a denial of service.
(CVE-2025-6075)
Caleb Brown discovered that Python incorrectly handled the ZIP64 End of
Central Directory (EOCD) Locator record offset value. An attacker could
possibly use this issue to obfuscate malicious content. (CVE-2025-8291)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python: Quadratic complexity in os.path.expandvars() with user-controlled template
vendor_redhat·2025-10-31·CVSS 1.8
CVE-2025-6075 [LOW] CWE-770 python: Quadratic complexity in os.path.expandvars() with user-controlled template
python: Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a
performance degradation is possible when expanding environment
variables.
A vulnerability in Python’s os.path.expandvars() function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denial of service (DoS) conditions. No code execution or data exposure occurs, so the impact is limited to performance slowdown.
Statement: This vulnerability is rated Low rather than Moderate because it only causes a performance inefficiency without affecting code execution, data
Microsoft
Quadratic complexity in os.path.expandvars() with user-controlled template
vendor_msrc·2025-10-14·CVSS 1.8
CVE-2025-6075 [LOW] CWE-400 Quadratic complexity in os.path.expandvars() with user-controlled template
Quadratic complexity in os.path.expandvars() with user-controlled template
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference
Debian
CVE-2025-6075: pypy3 - If the value passed to os.path.expandvars() is user-controlled a performance de...
vendor_debian·2025·CVSS 1.8
CVE-2025-6075 [LOW] CVE-2025-6075: pypy3 - If the value passed to os.path.expandvars() is user-controlled a performance de...
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-6075 asahi-installer: Quadratic complexity in os.path.expandvars() with user-controlled template [epel-10]
bugzilla·2025-11-06·CVSS 5.5
CVE-2025-6075 [MEDIUM] CVE-2025-6075 asahi-installer: Quadratic complexity in os.path.expandvars() with user-controlled template [epel-10]
CVE-2025-6075 asahi-installer: Quadratic complexity in os.path.expandvars() with user-controlled template [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This CVE is in the CPython interpreter, fixed by the python3 update; this package only uses the affected stdlib module and needs no change of its own.
Bugzilla
CVE-2025-6075 asahi-installer: Quadratic complexity in os.path.expandvars() with user-controlled template [fedora-all]
bugzilla·2025-11-06·CVSS 5.5
CVE-2025-6075 [MEDIUM] CVE-2025-6075 asahi-installer: Quadratic complexity in os.path.expandvars() with user-controlled template [fedora-all]
CVE-2025-6075 asahi-installer: Quadratic complexity in os.path.expandvars() with user-controlled template [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This CVE is in the CPython interpreter, fixed by the python3 update; this package only uses the affected stdlib module and needs no change of its own.
Bugzilla
CVE-2025-6075 python: Quadratic complexity in os.path.expandvars() with user-controlled template
bugzilla·2025-10-31·CVSS 1.8
CVE-2025-6075 [LOW] CVE-2025-6075 python: Quadratic complexity in os.path.expandvars() with user-controlled template
CVE-2025-6075 python: Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a
performance degradation is possible when expanding environment
variables.
Discussion:
The vulnerability was already fixed in all active branches, but the fixes are waiting to be released (except 3.9 and 3.15): https://github.com/python/cpython/issues/136065
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2025:23530 https://access.redhat.com/errata/RHSA-2025:23530
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:23342 https://access.redhat.com/errata/RHSA-2025:23342
https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8chttps://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebcahttps://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1bahttps://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5chttps://github.com/python/cpython/issues/136065https://mail.python.org/archives/list/[email protected]/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/
2025-10-31
Published