CVE-2025-6069 json
HTMLParser quadratic complexity when processing malformed inputs
published 2025-06-17 16 mo ago modified 2026-07-31 3 mo ago also BIT-libpython-2025-6069 , BIT-python-2025-6069 , BIT-python-min-2025-6069 , EUVD-2025-18496
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
Patch / fix
- bitnami libpython 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6
- bitnami python 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6
- bitnami python-min 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6
- Python Software Foundation CPython 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6, 3.14.0b3
- pypy3 Debian 14 7.3.21+dfsg-1
- python3.11 Debian 12 3.11.2-6+deb12u7
- python3.13 Debian 13 3.13.5-2+deb13u1
debian advisories DEBIAN-CVE-2025-6069
- python3.10 Ubuntu 22.04 LTS 3.10.12-1~22.04.11
- python3.12 Ubuntu 24.04 LTS 3.12.3-1ubuntu0.8
- python3.13 Ubuntu 25.10 3.13.6-1
- python3.4 Ubuntu Pro 14.04 LTS 3.4.3-1ubuntu1~14.04.7+esm16
- python3.5 Ubuntu Pro 14.04 LTS 3.5.2-2ubuntu0~16.04.4~14.04.1+esm7
- python3.5 Ubuntu Pro 16.04 LTS 3.5.2-2ubuntu0~16.04.13+esm19
- python3.6 Ubuntu Pro 18.04 LTS 3.6.9-1~18.04ubuntu1.13+esm6
- python3.7 Ubuntu Pro 18.04 LTS 3.7.5-2ubuntu1~18.04.2+esm7
ubuntu advisories UBUNTU-CVE-2025-6069
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- python3.9 RHEL 9 3.9.25-2.el9_7
- python3 RHEL 9 3.9.25-2.el9_7
- python3-idle RHEL 9 3.9.25-2.el9_7
- python3-libs RHEL 9 3.9.25-2.el9_7
- python3-test RHEL 9 3.9.25-2.el9_7
- python3-tkinter RHEL 9 3.9.25-2.el9_7
- python-unversioned-command RHEL 9 3.9.25-2.el9_7
- numpy RHEL 8 1.19.4-3.module+el8.9.0+19644+d68f775d
red hat advisories RHSA-2026:76945RHSA-2026:74087RHSA-2025:23342RHSA-2025:23530
- python313 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.13.11-160000.1.1
- python313-core SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.13.11-160000.1.1
- python313-documentation SLES for SAP applications 16.0, SLES 16.0 3.13.11-160000.1.1
- python313 SLE Module for Python 3 15 SP7 3.13.7-150700.4.23.1
- python313-core SLE Module for Python 3 15 SP7 3.13.7-150700.4.23.1
- python312 SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 3.12.11-150600.3.33.1
- python312-core SLE Module for Python 3 15 SP6, openSUSE Leap 15.6 3.12.11-150600.3.33.1
- python312-documentation openSUSE Leap 15.6 3.12.11-150600.3.33.1
suse advisories SUSE-SU-2026:20125-1SUSE-SU-2026:20154-1SUSE-SU-2025:3706-1SUSE-SU-2025:02359-1SUSE-SU-2025:02802-1SUSE-SU-2025:02778-1
- python313 openSUSE Leap 16.0 3.13.11-160000.1.1
- python313-core openSUSE Leap 16.0 3.13.11-160000.1.1
- python313-nogil openSUSE Leap 16.0 3.13.11-160000.1.1
- python313-documentation openSUSE Leap 16.0 3.13.11-160000.1.1
- python313-nogil-nogil-core openSUSE Leap 16.0 3.13.11-160000.1.1
- python315 openSUSE Tumbleweed 3.15.0~a1-1.1
- python311 openSUSE Tumbleweed 3.11.13-3.1
- python312 openSUSE Tumbleweed 3.12.11-3.1
opensuse advisories openSUSE-SU-2026:20081-1openSUSE-SU-2025:15713-1openSUSE-SU-2025:15365-1openSUSE-SU-2025:15366-1openSUSE-SU-2025:15367-1openSUSE-SU-2025:15285-1
- python39 AlmaLinux 8 3.9.25-2.module_el8.10.0+4083+53cad1fb
- python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
- python39-pip AlmaLinux 8 20.2.4-9.module_el8.10.0+3765+2f9a457d
- python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
- python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
- python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1
- python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+3248+c431e88c
- python39-idle AlmaLinux 8 3.9.25-2.module_el8.10.0+4083+53cad1fb
almalinux advisories ALSA-2025:23530ALSA-2025:23342
- python3.9 Rocky Linux 9 3.9.25-2.el9_7
- numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
- numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1860+afcc1c71
- scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1860+afcc1c71
- scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
- Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001
- Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1860+afcc1c71
- pytest Rocky Linux 8 6.0.2-2.module+el8.10.0+1860+afcc1c71
rocky linux advisories RLSA-2025:23342RLSA-2025:23530
- python3 CBL-Mariner 2.0 3.9.19-14
- python3 Azure Linux 3.0 3.12.9-3
azure linux advisories AZL-64173AZL-64178
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/python/cpython@4455cba commit
- github.com/python/cpython@6eb6c5d commit
- github.com/python/cpython@d851f8e commit
- github.com/python/cpython@8d1b3df commit
- github.com/python/cpython@ab0893f commit
- github.com/python/cpython@f3c6f88 commit
- github.com/python/cpython@fdc9d21 commit
- github.com/python/cpython#135464 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-6069 updated cvss 4.3
cpython: Python HTMLParser quadratic complexity
-
Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat Enterprise Linux 8 scipy, python3, python36, python3.11, python3.12, python-nose, +37 more Red Hat Enterprise Linux 9 python3.11, python3.12, python3.11-idle, python3.11-libs, python3.11-test, python3.12-idle, +4 more Red Hat Enterprise Linux 10 python3.12 Red Hat Enterprise Linux AI (RHEL AI) rhelai1/bootc-amd-rhel9, rhelai1/bootc-intel-rhel9, rhelai1/bootc-nvidia-rhel9, rhelai1/bootc-azure-amd-rhel9, rhelai1/instructlab-amd-rhel9, rhelai1/bootc-aws-nvidia-rhel9, +7 moreaffected: workaround, no fix available “Fix deferred”
-
Red Hat Ceph Storage 7 rhceph 1769508455fixed: vendor fix RHSA-2026:1858
-
Red Hat Ceph Storage 8 rhceph 1769512383fixed: vendor fix RHSA-2026:1652
-
Red Hat Discovery 2 discovery 1767888970, discovery 1767904573fixed: vendor fix RHSA-2026:0414
-
Red Hat Enterprise Linux AppStream (v. 8) scipy 1.5.4-5.module+el8.9.0+19644+d68f775d, numpy 1.19.4-3.module+el8.9.0+19644+d68f775d, PyYAML 5.4.1-1.module+el8.9.0+19644+d68f775d, python-ply 3.11-10.module+el8.9.0+19644+d68f775d, python39 3.9.25-2.module+el8.10.0+23718+1842ae33, mod_wsgi 4.7.1-7.module+el8.10.0+23075+0aa18782.1, +49 morefixed: vendor fix RHSA-2025:23530
-
Red Hat Enterprise Linux AppStream (v. 9) python3-tkinter 3.9.25-2.el9_7, python-unversioned-command 3.9.25-2.el9_7fixed: vendor fix RHSA-2025:23342
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) python3-tkinter 3.9.16-1.el9_2.15, python-unversioned-command 3.9.16-1.el9_2.15fixed: vendor fix RHSA-2026:76945
-
Red Hat Enterprise Linux AppStream E4S (v.9.4) python3-tkinter 3.9.18-3.el9_4.14, python-unversioned-command 3.9.18-3.el9_4.14fixed: vendor fix RHSA-2026:74087
show 7 moreshow fewer
-
Red Hat Enterprise Linux BaseOS (v. 9) python3 3.9.25-2.el9_7, python3.9 3.9.25-2.el9_7, python3-libs 3.9.25-2.el9_7fixed: vendor fix RHSA-2025:23342
-
Red Hat Enterprise Linux BaseOS E4S (v.9.2) python3 3.9.16-1.el9_2.15, python3.9 3.9.16-1.el9_2.15, python3-libs 3.9.16-1.el9_2.15fixed: vendor fix RHSA-2026:76945
-
Red Hat Enterprise Linux BaseOS E4S (v.9.4) python3 3.9.18-3.el9_4.14, python3.9 3.9.18-3.el9_4.14, python3-libs 3.9.18-3.el9_4.14fixed: vendor fix RHSA-2026:74087
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3 3.9.25-2.el9_7, python3-idle 3.9.25-2.el9_7, python3-test 3.9.25-2.el9_7, python3-tkinter 3.9.25-2.el9_7fixed: vendor fix RHSA-2025:23342
-
Red Hat Enterprise Linux CRB (v. 8) pytest 6.0.2-2.module+el8.9.0+19644+d68f775d, Cython 0.29.21-5.module+el8.9.0+19644+d68f775d, pybind11 2.7.1-1.module+el8.9.0+19644+d68f775d, python-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python39-py 1.10.0-1.module+el8.9.0+19644+d68f775d, python-attrs 20.3.0-2.module+el8.9.0+19644+d68f775d, +16 morefixed: vendor fix RHSA-2025:23530
-
Red Hat Update Infrastructure 5 rhui5 1768221100, rhui5 1768221107, rhui5 1768296285, rhui5 1768377012fixed: vendor fix RHSA-2026:0685
-
Red Hat Ceph Storage 7 rhceph 1769511650, rhceph 1769512818, rhceph 1769513068, rhceph 1769514555, rhceph 1769523636 Red Hat Ceph Storage 8 rhceph 1768902743, rhceph 1768903190, rhceph 1768903749, rhceph 1768907469, rhceph 1768915405not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | libpython | <3.9.24 >=3.10.0, <3.10.19 >=3.11.0, <3.11.14 >=3.12.0, <3.12.12 >=3.13.0, <3.13.6 |
3.9.24 3.10.19 3.11.14 3.12.12 3.13.6 |
| bitnami | python | <3.9.24 >=3.10.0, <3.10.19 >=3.11.0, <3.11.14 >=3.12.0, <3.12.12 >=3.13.0, <3.13.6 |
3.9.24 3.10.19 3.11.14 3.12.12 3.13.6 |
| bitnami | python-min | <3.9.24 >=3.10.0, <3.10.19 >=3.11.0, <3.11.14 >=3.12.0, <3.12.12 >=3.13.0, <3.13.6 |
3.9.24 3.10.19 3.11.14 3.12.12 3.13.6 |
Affected products
- Python Software Foundation CPython
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/python/cpython/pull/135464
patch, web
-
github.com
/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949
patch, web
-
github.com
/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41
patch, web
-
github.com
/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b
patch, web
-
github.com
/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49
patch, web
-
github.com
/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5
patch, web
-
github.com
/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc
patch, web
-
github.com
/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15
patch, web
-
mail.python.org
/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/
vendor-advisory, web
-
github.com
/python/cpython/issues/135462
issue-tracking, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-6069
web
Sources
- CVE List CVE-2025-6069
- NVD CVE-2025-6069
- OSV BIT-libpython-2025-6069
- OSV BIT-python-2025-6069
- OSV BIT-python-min-2025-6069
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.