CVE-2025-6069

Jython is an implementation of the high-level, dynamic, object-oriented language Python seamlessly integrated with the Java platform. The predecessor to Jython, JPython, is certified as 100% Pure Java. Jython is freely available for both commercial and non-commercial use and is distributed with source code. Jython is complementary to Java and is especially suited for the following tasks: Embedded scripting - Java programmers can add the Jython libraries to their system to allow end users to write simple or complicated scripts that add functionality to the application. Interactive experimentation - Jython provides an interactive interpreter that can be used to interact with Java packages or with running Java applications. This allows programmers to experiment and debug any Java system using Jython. Rapid application development - Python programs are typically 2-10X shorter than the equivalent Java program. This translates directly to increased programmer productivity. The seamless interaction between Python and Java allows developers to freely mix the two languages both during development and in shipping products.

Security Fix(es):

Python is an open source, object-oriented programming language from the Python Foundation. This language has the characteristics of scalability, supporting modules and packages, and supporting multiple platforms. There is a security vulnerability in Python that originates from the secondary complexity problem when handling specially crafted malformed inputs, which may lead to a denial of service attack.(CVE-2025-6069)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

A vulnerability, which was classified as critical, was found in Python CPython up to 3.14.0b1 (Programming Language Software).CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.14.0b2 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-4517)

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

A vulnerability, which was classified as critical, was found in Python CPython up to 3.14.0b1 (Programming Language Software).CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.14.0b2 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-4517)

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)

• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)

• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)

• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)

• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)

• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)

• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)

• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)

• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)

• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)

• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)

• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)

• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642)
• python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287)
• python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168)
• python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938)
• cpython: python: CPython DecodeError Handling Vulnerability (CVE-2025-4516)
• cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
• cpython: python: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
• python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
• cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
• cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
• cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)
• python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

• CVE-2025-8291: fix zipfile ZIP64 EOCD Locator offset validation
• CVE-2025-6069: fix quadratic complexity in HTMLParser
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with error handler
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2025-1795: fix email header list separator incorrectly encoded during folding
• CVE-2026-0672: reject control characters in http cookies
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update(), |=, unpickling, and js_output()
• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat.c
• CVE-2025-11468: preserve parens when folding email comments to prevent header injection

• CVE-2026-0672: reject control characters in http.cookies cookie names, values, and parameters to prevent header injection
• CVE-2026-3644: reject control characters in Morsel.update(), |= operator, and unpickling paths missed by CVE-2026-0672; add output validation to BaseCookie.js_output()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code so sys.audit handlers fire for legacy .pyc imports
• CVE-2025-8291: validate ZIP64 End of Central Directory locator offset to prevent ZIP archive parser confusion
• CVE-2025-6069: fix quadratic complexity in html.parser.HTMLParser when processing crafted malformed inputs
• CVE-2025-4516: fix use-after-free in unicode-escape decoder when an error handler is invoked
• CVE-2025-1795: stop incorrectly RFC 2047 encoding the comma separator when an address list is folded

• CVE-2025-1795: fix incorrect parsing of email addresses with special chars
• CVE-2025-4516: fix use-after-free in unicode-escape decoder with non-strict error handler
• CVE-2025-6069: fix quadratic complexity in HTMLParser special input
• CVE-2025-8291: fix zip64 end-of-central-directory record validation
• CVE-2025-11468: fix incorrect parsing of empty email display names
• CVE-2025-15282: fix control character injection in data: URL mediatype in urllib.request.DataHandler
• CVE-2024-5642: fix buffer over-read in ssl.SSLContext.set_npn_protocols with empty list

• CVE-2026-4224: avoid unbound C recursion in conv_content_model in pyexpat
• CVE-2026-3644: reject control characters in http.cookies.Morsel.update()
• CVE-2026-0672: reject control characters in http.cookies.Morsel
• CVE-2025-8291: check consistency of zip64 end of central directory record
• CVE-2025-6069: fix quadratic complexity in processing special input in HTMLParser
• CVE-2025-4516: fix use-after-free in the unicode-escape decoder with error handler
• CVE-2025-15282: reject control characters in data URL mediatypes
• CVE-2025-11468: preserve parenthesis when folding email comments
• CVE-2026-3479: reject invalid resource arguments in pkgutil.get_data()
• CVE-2026-2297: ensure SourcelessFileLoader uses io.open_code
• CVE-2024-5642: disallow setting an empty list for ssl NPN protocols

These are all security issues fixed in the python310-3.10.18-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.0~b3-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.23-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.13-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.11-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.5-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python313 fixes the following issues:

• Update to 3.13.11:

• Security

  • CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
  • CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
  • CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)
  • CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) not checked by the 'zipfile' module (bsc#1251305)
  • gh-137836: Add support of the “plaintext” element, RAWTEXT elements “xmp”, “iframe”, “noembed” and “noframes”, and optionally RAWTEXT element “noscript” in html.parser.HTMLParser.
  • gh-136063: email.message: ensure linear complexity for legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  • CVE-2025-6075: Fixed performance issues caused by user-controller os.path.expandvars() (bsc#1252974)

• Library

  • gh-140797: Revert changes to the undocumented re.Scanner class. Capturing groups are still allowed for backward compatibility, although using them can lead to incorrect result. They will be forbidden in future Python versions.
  • gh-142206: The resource tracker in the multiprocessing module now uses the original communication protocol, as in Python 3.14.0 and below, by default. This avoids issues with upgrading Python while it is running. (Note that such ‘in-place’ upgrades are not tested.) The tracker remains compatible with subprocesses that use new protocol (that is, subprocesses using Python 3.13.10, 3.14.1 and 3.15).

• Core and Builtins

  • gh-142218: Fix crash when inserting into a split table dictionary with a non str key that matches an existing key.

• Update to 3.13.10:

• Tools/Demos

  • gh-141442: The iOS testbed now correctly handles test arguments that contain spaces.

• Tests

  • gh-140482: Preserve and restore the state of stty echo as part of the test environment.
  • gh-140082: Update python -m test to set FORCE_COLOR=1 when being run with color enabled so that unittest which is run by it with redirected output will output in color.
  • gh-136442: Use exitcode 1 instead of 5 if unittest.TestCase.setUpClass() raises an exception

• Library

  • gh-74389: When the stdin being used by a subprocess.Popen instance is closed, this is now ignored in subprocess.Popen.communicate() instead of leaving the class in an inconsistent state.
  • gh-87512: Fix subprocess.Popen.communicate() timeout handling on Windows when writing large input. Previously, the timeout was ignored during stdin writing, causing the method to block indefinitely if the child process did not consume input quickly. The stdin write is now performed in a background thread, allowing the timeout to be properly enforced.
  • gh-141473: When subprocess.Popen.communicate() was called with input and a timeout and is called for a second time after a TimeoutExpired exception before the process has died, it should no longer hang.
  • gh-59000: Fix pdb breakpoint resolution for class methods when the module defining the class is not imported.
  • gh-141570: Support file-like object raising OSError from fileno() in color detection (_colorize.can_colorize()). This can occur when sys.stdout is redirected.
  • gh-141659: Fix bad file descriptor errors from _posixsubprocess on AIX.
  • gh-141497: ipaddress: ensure that the methods IPv4Network.hosts() and IPv6Network.hosts() always return an iterator.
  • gh-140938: The statistics.stdev() and statistics.pstdev() functions now raise a ValueError when the input contains an infinity or a NaN.
  • gh-124111: Updated Tcl threading configuration in _tkinter to assume that threads are…

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

Root has patched CVE-2025-6069 in the rootio-python3.9 package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-6069 in the rootio-python3.11 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-6069 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available.

This update for python39 fixes the following issues:

• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).

This update for python36 fixes the following issues:

• CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside extraction directory (bsc#1244056)
• CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory, and the modification of some file metadata (bsc#1244059)
• CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory (bsc#1244060)
• CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
• CVE-2025-4516: Fixed denial of service due to DecodeError handling vulnerability (bsc#1243273)
• CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
• CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705)

Other fixes:

• Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15 migration (bsc#1233012)
• Update vendored ipaddress module to 3.8 equivalent
• Limit buffer size for IPv6 address parsing (bsc#1244401).

This update for python311 fixes the following issues:

• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).

This update for python312 fixes the following issues:

• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).
• CVE-2025-4435: Fixed that Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)

This update for python3 fixes the following issues:

• CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside extraction directory (bsc#1244056)
• CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory, and the modification of some file metadata (bsc#1244059)
• CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory (bsc#1244060)
• CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
• CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
• CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705)

This update for python fixes the following issues:

• CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)

This update for python fixes the following issues:

• CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)

This update for python310 fixes the following issues:

• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).

This update for python311 fixes the following issues:

• CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).
• CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).

This update for python313 fixes the following issues:

• CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).
• CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).