Skip to content
Fencer Vulns
medium 5.3

CVE-2025-12781 json

base64.b64decode() always accepts "+/" characters, despite setting altchars

published 2026-01-21 9 mo ago modified 2026-06-17 4 mo ago also BIT-libpython-2025-12781 , BIT-python-2025-12781 , BIT-python-min-2025-12781 , EUVD-2026-3598

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.

This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.

The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.

Patch / fix

  • bitnami libpython 3.15.0
  • bitnami python 3.15.0
  • bitnami python-min 3.15.0
  • Python Software Foundation CPython 3.13.10, 3.14.1, 3.15.0a2
  • python3.14 Debian 14 3.14.2-1

debian advisories DEBIAN-CVE-2025-12781

  • python311 Linux Micro 6.1 3.11.14-slfo.1.1_3.1
  • python311-core Linux Micro 6.1 3.11.14-slfo.1.1_3.1
  • python311 Linux Micro 6.0 3.11.14-3.1
  • python311-core Linux Micro 6.0 3.11.14-3.1
  • python311 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Python 3 15 SP7 +1 more 3.11.14-150600.3.44.1
  • python311-core SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Python 3 15 SP7 +2 more 3.11.14-150600.3.44.1
  • python311-documentation openSUSE Leap 15.6 3.11.14-150600.3.44.1
  • python311 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +6 more 3.11.14-150400.9.75.1

suse advisories SUSE-SU-2026:20665-1SUSE-SU-2026:20710-1SUSE-SU-2026:0767-1SUSE-SU-2026:0693-1

  • python311 openSUSE Tumbleweed 3.11.14-4.1
  • python312 openSUSE Tumbleweed 3.12.12-5.1
  • python314 openSUSE Tumbleweed 3.14.3-1.1
  • python315 openSUSE Tumbleweed 3.15.0~a3-4.1

opensuse advisories openSUSE-SU-2026:10221-1openSUSE-SU-2026:10222-1openSUSE-SU-2026:10206-1openSUSE-SU-2026:10152-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-12781 updated cvss 5.3

cpython: base64.b64decode() always accepts "+/" characters, despite setting altchars

  • Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, firefox, python3, tkinter, python-libs, python-test, +5 more Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, firefox, python3, mod_wsgi, +90 more Red Hat Enterprise Linux 9 firefox, python3, python3.9, python3.11, python3.12, python3.14, +23 more Red Hat Enterprise Linux 10 firefox, python3.12, python3.14 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images python3.11, python3.12, python3.13, python3.14
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces/pluginregistry-rhel9, devspaces-tech-preview/idea-rhel9
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/python/cpython/issues/125346 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami libpython
<3.15.0
3.15.0
bitnami python
<3.15.0
3.15.0
bitnami python-min
<3.15.0
3.15.0

Affected products

  • Python Software Foundation CPython

Classification

Weakness
  • CWE-704 Incorrect Type Conversion or Cast

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.