CVE-2025-6075

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.(CVE-2025-6075)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)

• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)

• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)

• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)

• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)

• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)

• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)

• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)

• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)

• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)

• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)

• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

• cpython: Out-of-memory when loading Plist (CVE-2025-13837)

• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)
• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)
• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)
• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
• cpython: Out-of-memory when loading Plist (CVE-2025-13837)
• cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
• cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
• cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
• cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
• cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
• python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
• python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
• python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
• python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

• CVE-2025-6075: fix quadratic complexity in os.path.expandvars()

• CVE-2025-6075: fix quadratic complexity in os.path.expandvars()

• CVE-2025-6075: fix quadratic complexity in os.path.expandvars()

• CVE-2025-6075: fix quadratic complexity in os.path.expandvars()

• SECURITY UPDATE: fix quadratic complexity in http cookie parsing with backslash escapes
  • debian/patches/CVE-2024-7592.patch: fix quadratic complexity in http cookie parsing with backslash escapes
  • CVE-2024-7592
• SECURITY UPDATE: reject leading dashes in webbrowser URLs and %action substitution bypass
  • debian/patches/CVE-2026-4519.patch: reject leading dashes in webbrowser URLs and %action substitution bypass
  • CVE-2026-4519
• SECURITY UPDATE: fix quadratic complexity in os.path.expandvars()
  • debian/patches/CVE-2025-6075.patch: fix quadratic complexity in os.path.expandvars()
  • CVE-2025-6075
• SECURITY UPDATE: remove quadratic behavior in xml.dom.minidom node id-cache clearing
  • debian/patches/CVE-2025-12084.patch: remove quadratic behavior in xml.dom.minidom node id-cache clearing
  • CVE-2025-12084
• SECURITY UPDATE: remove backtracking when parsing tarfile PAX headers
  • debian/patches/CVE-2024-6232.patch: remove backtracking when parsing tarfile PAX headers
  • CVE-2024-6232
• SECURITY UPDATE: reject malformed addresses in email.utils.parseaddr / getaddresses
  • debian/patches/CVE-2023-27043.patch: reject malformed addresses in email.utils.parseaddr / getaddresses
  • CVE-2023-27043

These are all security issues fixed in the python312-3.12.12-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.9-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.14-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.19-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.24-2.1 package on the GA media of openSUSE Tumbleweed.

This update for python313 fixes the following issues:

• Update to 3.13.11:

• Security

  • CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
  • CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
  • CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)
  • CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) not checked by the 'zipfile' module (bsc#1251305)
  • gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser.
  • gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  • CVE-2025-6075: Fixed performance issues caused by user-controller os.path.expandvars() (bsc#1252974)

• Library

  • gh-140797: Revert changes to the undocumented re.Scanner class. Capturing groups are still allowed for backward compatibility, although using them can lead to incorrect result. They will be forbidden in future Python versions.
  • gh-142206: The resource tracker in the multiprocessing module now uses the original communication protocol, as in Python 3.14.0 and below, by default. This avoids issues with upgrading Python while it is running. (Note that such ‘in-place’ upgrades are not tested.) The tracker remains compatible with subprocesses that use new protocol (that is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).

• Core and Builtins

  • gh-142218: Fix crash when inserting into a split table dictionary with a non str key that matches an existing key.

• Update to 3.13.10:

• Tools/Demos

  • gh-141442: The iOS testbed now correctly handles test arguments that contain spaces.

• Tests

  • gh-140482: Preserve and restore the state of stty echo as part of the test environment.
  • gh-140082: Update python -m test to set FORCE_COLOR=1 when being run with color enabled so that unittest which is run by it with redirected output will output in color.
  • gh-136442: Use exitcode 1 instead of 5 if unittest.TestCase.setUpClass() raises an exception

• Library

  • gh-74389: When the stdin being used by a subprocess.Popen instance is closed, this is now ignored in subprocess.Popen.communicate() instead of leaving the class in an inconsistent state.
  • gh-87512: Fix subprocess.Popen.communicate() timeout handling on Windows when writing large input. Previously, the timeout was ignored during stdin writing, causing the method to block indefinitely if the child process did not consume input quickly. The stdin write is now performed in a background thread, allowing the timeout to be properly enforced.
  • gh-141473: When subprocess.Popen.communicate() was called with input and a timeout and is called for a second time after a TimeoutExpired exception before the process has died, it should no longer hang.
  • gh-59000: Fix pdb breakpoint resolution for class methods when the module defining the class is not imported.
  • gh-141570: Support file-like object raising OSError from fileno() in color detection (_colorize.can_colorize()). This can occur when sys.stdout is redirected.
  • gh-141659: Fix bad file descriptor errors from _posixsubprocess on AIX.
  • gh-141497: ipaddress: ensure that the methods IPv4Network.hosts() and IPv6Network.hosts() always return an iterator.
  • gh-140938: The statistics.stdev() and statistics.pstdev() functions now raise a ValueError when the input contains an infinity or a NaN.
  • gh-124111: Updated Tcl threading configuration in _tkinter to assume that threads are…

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Root has patched CVE-2025-6075 in the rootio-python3.11 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-6075 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available.

This update for python311 fixes the following issues:

Update to 3.11.14:

• CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) is not checked by the 'zipfile' module (bsc#1251305).
• CVE-2025-6075: Fixed the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables (bsc#1252974).

This update for python311 fixes the following issues:

Update to 3.11.14:

• CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) is not checked by the 'zipfile' module (bsc#1251305).
• CVE-2025-6075: Fixed the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables (bsc#1252974).