CVE Vulnerabilities

CVE-2025-12084

Inefficient Algorithmic Complexity

Published: Dec 03, 2025 | Modified: Jan 14, 2026
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Weakness

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Software

Name Vendor Start Version End Version
Python Python * 3.13.11 (excluding)
Python Python 3.14.0 (including) 3.14.2 (excluding)
Python Python 3.15.0-alpha1 (including) 3.15.0-alpha1 (including)
Python Python 3.15.0-alpha2 (including) 3.15.0-alpha2 (including)
Red Hat Enterprise Linux 8 RedHat python3.12-0:3.12.12-1.el8_10 *
Jython Ubuntu plucky *
Pypy3 Ubuntu plucky *
Python3.13 Ubuntu plucky *
Python3.13 Ubuntu upstream *
Python3.14 Ubuntu upstream *

References