Executive brief
A performance issue was identified in the Python programming language's standard library, specifically in how it handles system environment variables within file paths. If an application allows a user to provide input that is then processed by this specific function, an attacker could provide a specially crafted string that causes the application to slow down significantly or stop responding. This could lead to a denial-of-service condition, impacting the availability of the affected service.
Technical details
A vulnerability exists in CPython's 'os.path.expandvars()' function due to quadratic complexity (CWE-400) when processing environment variable expansions. An attacker who can provide a specially crafted string to this function can trigger excessive CPU consumption, leading to a local denial-of-service. The issue stems from inefficient string processing during the expansion of shell-style variables (e.g., $var, ${var}, or %var%). Patches have been released across multiple CPython release branches to optimize the expansion logic and mitigate the performance degradation.
Affected products
- Python Software Foundation CPython 3.10.0 < 3.10.20, 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.10, 3.14.0 < 3.14.1, 3.15.0a1 < 3.15.0a2
Timeline
- 2025-10-31: advisory: Vulnerability published by NVD
- 2025-10-31: patched: Fixes committed to CPython repository
References
- https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c
- https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427
- https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84
- https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca
- https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742
- https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba
- https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c