# CVE-2025-6075: Python CPython quadratic complexity in os.path.expandvars

Source: https://junglewise.ai/threats/cve-2025-6075-python-cpython-quadratic-complexity-in-os-path-expandvars  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-31. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-6075 · Severity: medium · CVSS 5.5 · Published 2025-10-31

A performance issue was identified in the Python programming language's standard library, specifically in how it handles system environment variables within file paths. If an application allows a user to provide input that is then processed by this specific function, an attacker could provide a specially crafted string that causes the application to slow down significantly or stop responding. This could lead to a denial-of-service condition, impacting the availability of the affected service.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2025-6075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-6075 being exploited in the wild.

**How severe is CVE-2025-6075?** Medium severity, with a CVSS score of 5.5, published 31 October 2025.

**Which products and versions are affected?** Python Software Foundation CPython 3.10.0 < 3.10.20, 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.10, 3.14.0 < 3.14.1, 3.15.0a1 < 3.15.0a2.

**Is there a fix for CVE-2025-6075?** A patch was published on 2025-10-31: Fixes committed to CPython repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-6075 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-6075?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in CPython's 'os.path.expandvars()' function due to quadratic complexity (CWE-400) when processing environment variable expansions. An attacker who can provide a specially crafted string to this function can trigger excessive CPU consumption, leading to a local denial-of-service. The issue stems from inefficient string processing during the expansion of shell-style variables (e.g., $var, ${var}, or %var%). Patches have been released across multiple CPython release branches to optimize the expansion logic and mitigate the performance degradation.

## Affected products

- Python Software Foundation CPython 3.10.0 < 3.10.20, 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.10, 3.14.0 < 3.14.1, 3.15.0a1 < 3.15.0a2

## Timeline

- 2025-10-31: advisory: Vulnerability published by NVD
- 2025-10-31: patched: Fixes committed to CPython repository

## References

- [https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c](https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c)
- [https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427](https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427)
- [https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84](https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84)
- [https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca](https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca)
- [https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742](https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742)
- [https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba](https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba)
- [https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c](https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)