CVE-2025-6069
Medium
Description
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
SeverityMedium
CVSS4.3
Exploit probability—
ProductCPython
PublishedJun 17, 2025
First seenJun 17, 2025
Weakness typeCWE-1333CWE-1333
How to fix
Update
- Python Software Foundation CPython3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6, 3.14.0b3 or later
Patches
- github.com/python/cpython/pull/135464
- github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949
- github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41
- github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b
- github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49
- github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5
- github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc
- github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.9.24, 3.10.0 ≤ v < 3.10.19, 3.11.0 ≤ v < 3.11.14, 3.12.0 ≤ v < 3.12.12, 3.13.0 ≤ v < 3.13.6, 3.14.0a1 ≤ v < 3.14.0b3 | 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6, 3.14.0b3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.