Junglewise Threat Intelligence

CVE-2025-6075: Python CPython quadratic complexity in os.path.expandvars

CVE-2025-6075 · Severity: medium · CVSS 5.5 · Published 2025-10-31

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Executive brief

A performance issue was identified in the Python programming language's standard library, specifically in how it handles system environment variables within file paths. If an application allows a user to provide input that is then processed by this specific function, an attacker could provide a specially crafted string that causes the application to slow down significantly or stop responding. This could lead to a denial-of-service condition, impacting the availability of the affected service.

Technical details

A vulnerability exists in CPython's 'os.path.expandvars()' function due to quadratic complexity (CWE-400) when processing environment variable expansions. An attacker who can provide a specially crafted string to this function can trigger excessive CPU consumption, leading to a local denial-of-service. The issue stems from inefficient string processing during the expansion of shell-style variables (e.g., $var, ${var}, or %var%). Patches have been released across multiple CPython release branches to optimize the expansion logic and mitigate the performance degradation.

Affected products

  • Python Software Foundation CPython 3.10.0 < 3.10.20, 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.10, 3.14.0 < 3.14.1, 3.15.0a1 < 3.15.0a2

Timeline

  • 2025-10-31: advisory: Vulnerability published by NVD
  • 2025-10-31: patched: Fixes committed to CPython repository

References

Related threats