CVE-2025-12084

Dec. 22, 2025, 8:15 p.m.

6.3
Medium

Description

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Product(s) Impacted

Vendor Product Versions
Python
  • Python
  • *, 3.15.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-407
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a python python / / / / / / / /
a python python / / / / / / / /
a python python 3.15.0 alpha1 / / / / / /
a python python 3.15.0 alpha2 / / / / / /

References

https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0
https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4
https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437
https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907
https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d
https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8
https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964
https://github.com/python/cpython/issues/142145
https://github.com/python/cpython/pull/142146

Tags

cna@python.org
CWE-407
2025-12-03
CVE-2025-12084

CVSS Score

6.3 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: PRESENT
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Dec. 3, 2025, 7:15 p.m.
Last Modified: Dec. 22, 2025, 8:15 p.m.

Status : Modified

CVE has been amended by a source (CVE Primary CNA or another CNA). Analysis data supplied by the NVD may be no longer be accurate due to these changes.

More info

Source

cna@python.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.