CVE-2025-6075 Quadratic complexity in os.path.expandvars() with user-controlled template
Attackers can cause denial of service by providing user-controlled input to os.path.expandvars(), triggering quadratic complexity in environment variable expansion.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-6075?
CVE-2025-6075 is a low-severity denial of service vulnerability in Python Python, published on 31 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
Weakness: CWE-400
Which versions are affected by CVE-2025-6075?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.9.25, 3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1 |
python Bitnami | All versions | 3.9.25, 3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1 |
python-min Bitnami | All versions | 3.9.25, 3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1 |
Linux distribution packages (6)
python SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.99.1 |
python-base SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.7.18-150000.99.1 |
python openSUSE:Leap 15.6 | All versions | 2.7.18-150000.99.1 |
python-base openSUSE:Leap 15.6 | All versions | 2.7.18-150000.99.1 |
python-doc openSUSE:Leap 15.6 | All versions | 2.7.18-150000.99.1 |
python315 openSUSE:Tumbleweed | All versions | 3.15.0~a1-2.1 |
Products include Python Python.
How do I fix CVE-2025-6075?
Upgrade libpython to a fixed version for your release line: 3.9.25, 3.10.20, 3.11.15 or 3.12.13.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-6075 being exploited?
There is no known exploitation of CVE-2025-6075 in the wild and no public exploit code.
Other vulnerabilities in Python Python
Sources
Also known as AZL-109695, AZL-69625, AZL-69628, BIT-libpython-2025-6075, BIT-python-2025-6075, BIT-python-min-2025-6075 and 17 more.