CVE-2025-12084: Quadratic complexity in node ID cache clearing
Quadratic complexity in node ID cache clearing
Other sources
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on clearidcache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
azurelinux/python3to a version that resolves this vulnerability.Fixed in 3.9.19-19 - Upgrade
Upgrade
azurelinux/python3to a version that resolves this vulnerability.Fixed in 3.12.9-7 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.21+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u7 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.2-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.10-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12084?
CVE-2025-12084 has the potential to significantly impact availability due to its quadratic algorithm when processing excessively nested documents.
How do I fix CVE-2025-12084?
Fixing CVE-2025-12084 involves updating to the latest version of Python's xml.dom.minidom which includes optimizations for handling nested elements.
What is the impact of CVE-2025-12084?
CVE-2025-12084 can lead to performance issues or application crashes when dealing with deeply nested XML documents.
Which versions of Python xml.dom.minidom are affected by CVE-2025-12084?
CVE-2025-12084 affects all versions of Python xml.dom.minidom that utilize the vulnerable appendChild() methods.
Is CVE-2025-12084 easily exploitable?
CVE-2025-12084 is primarily a performance-based issue and is not directly exploitable in a security context, but it can degrade application functionality.