CVE-2025-6069 HTMLParser quadratic complexity when processing malformed inputs
Attackers can cause denial of service in applications using Python's HTMLParser by submitting crafted malformed inputs that trigger quadratic complexity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-6069?
CVE-2025-6069 is a medium-severity denial of service vulnerability in CPython, published on 17 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
Weakness: CWE-1333
Which versions are affected by CVE-2025-6069?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6 |
python Bitnami | All versions | 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6 |
python-min Bitnami | All versions | 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6 |
Linux distribution packages (21)
python SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 2.7.18-150000.80.1 |
python-base SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 2.7.18-150000.80.1 |
python SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.80.1 |
python-base SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.80.1 |
python311 SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.11.13-150400.9.63.1 |
python311-core SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.11.13-150400.9.63.1 |
python SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.7.18-33.50.1 |
python-base SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.7.18-33.50.1 |
python-doc SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.7.18-33.50.1 |
python openSUSE:Leap 15.6 | All versions | 2.7.18-150000.80.1 |
python-base openSUSE:Leap 15.6 | All versions | 2.7.18-150000.80.1 |
python-doc openSUSE:Leap 15.6 | All versions | 2.7.18-150000.80.1 |
python310 openSUSE:Leap 15.6 | All versions | 3.10.18-150400.4.85.1 |
python310-core openSUSE:Leap 15.6 | All versions | 3.10.18-150400.4.85.1 |
python310-documentation openSUSE:Leap 15.6 | All versions | 3.10.18-150400.4.85.1 |
python39 openSUSE:Leap 15.6 | All versions | 3.9.23-150300.4.78.1 |
python39-core openSUSE:Leap 15.6 | All versions | 3.9.23-150300.4.78.1 |
python39-documentation openSUSE:Leap 15.6 | All versions | 3.9.23-150300.4.78.1 |
python311 openSUSE:Tumbleweed | All versions | 3.11.13-3.1 |
python312 openSUSE:Tumbleweed | All versions | 3.12.11-3.1 |
python313 openSUSE:Tumbleweed | All versions | 3.13.5-3.1 |
How do I fix CVE-2025-6069?
Upgrade libpython to a fixed version for your release line: 3.9.24, 3.10.19, 3.11.14 or 3.12.12.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-6069 being exploited?
There is no known exploitation of CVE-2025-6069 in the wild and no public exploit code.
Sources
Also known as AZL-64173, AZL-64178, BIT-libpython-2025-6069, BIT-python-2025-6069, BIT-python-min-2025-6069, DEBIAN-CVE-2025-6069 and 20 more.