CVE-2025-6075: Quadratic complexity in os.path.expandvars() with user-controlled template

Q: What is the severity of CVE-2025-6075?

CVE-2025-6075 has a high severity due to potential performance degradation caused by quadratic complexity in user-controlled inputs.

Q: How do I fix CVE-2025-6075?

To mitigate CVE-2025-6075, ensure that user inputs to os.path.expandvars() are properly validated to avoid performance issues.

Q: What software versions are affected by CVE-2025-6075?

CVE-2025-6075 affects several versions of Microsoft Python distributions, specifically cbl2 and azl3 Python versions.

Q: Is there a known exploit for CVE-2025-6075?

As of now, there are no known exploits specifically targeting CVE-2025-6075, but the vulnerability could be leveraged in denial-of-service scenarios.

Q: What are the potential impacts of CVE-2025-6075?

The primary impact of CVE-2025-6075 is reduced application performance due to inefficient processing of environment variables.

Published Oct 31, 2025

Updated

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

Other sources

Quadratic complexity in os.path.expandvars() with user-controlled template

— Microsoft

Affected Software

21 affected componentsFixes available

IBM Netezza Software<=11.3.0.3-IF2

Python Python<3.9.0

Python Python>=3.13.1<3.13.11

Python Python>=3.14.0<3.14.1

Python Python=3.15.0-alpha1

All of the following

azurelinux/python3<3.9.19-17

3.9.19-17

Microsoft CBL-Mariner=2.0

All of the following

azurelinux/python3<3.12.9-6

3.12.9-6

Microsoft Azure Linux=3.0

All of the following

azurelinux/python3=3.9.19-15

Microsoft CBL-Mariner=2.0

debian/pypy3*

debian/pypy3<7.3.21+dfsg-1

7.3.21+dfsg-1

debian/python3.11<3.11.2-6+deb12u7

3.11.2-6+deb12u7

debian/python3.13<3.13.5-2+deb13u1

3.13.5-2+deb13u1

debian/python3.14<3.14.2-1

3.14.2-1

debian/pypy3<=7.3.11+dfsg-2+deb12u3, <=7.3.19+dfsg-2

8.0.1+dfsg-1

debian/python3.11

3.11.2-6+deb12u83.11.2-6+deb12u9

debian/python3.13

3.13.5-2+deb13u53.13.18-1

debian/python3.14

3.14.10-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azurelinux/python3 to a version that resolves this vulnerability.
Fixed in 3.9.19-17
Upgrade
Upgrade azurelinux/python3 to a version that resolves this vulnerability.
Fixed in 3.12.9-6
Upgrade
Upgrade debian/pypy3 to a version that resolves this vulnerability.
Fixed in 7.3.21+dfsg-1
Upgrade
Upgrade debian/python3.11 to a version that resolves this vulnerability.
Fixed in 3.11.2-6+deb12u7
Upgrade
Upgrade debian/python3.13 to a version that resolves this vulnerability.
Fixed in 3.13.5-2+deb13u1
Upgrade
Upgrade debian/python3.14 to a version that resolves this vulnerability.
Fixed in 3.14.2-1
Upgrade
Upgrade debian/pypy3 to a version that resolves this vulnerability.
Fixed in 8.0.1+dfsg-1
Upgrade
Upgrade debian/python3.11 to a version that resolves this vulnerability.
Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9
Upgrade
Upgrade debian/python3.13 to a version that resolves this vulnerability.
Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1
Upgrade
Upgrade debian/python3.14 to a version that resolves this vulnerability.
Fixed in 3.14.10-1

Event History

Oct 31, 2025

CVE Published

via MITRE·04:41 PM

Data Sourced

via MITRE·04:41 PM

Description

Data Sourced

via OSV·04:41 PM

DescriptionSeverity

Data Sourced

via Red Hat·05:02 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·05:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·05:15 PM

Affected Software

Nov 5, 2025

Data Sourced

via Microsoft·01:02 AM

DescriptionSeverityWeaknessAffected Software

Aug 20, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7284359

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4445-1

Frequently Asked Questions

What is the severity of CVE-2025-6075?

CVE-2025-6075 has a high severity due to potential performance degradation caused by quadratic complexity in user-controlled inputs.

How do I fix CVE-2025-6075?

To mitigate CVE-2025-6075, ensure that user inputs to os.path.expandvars() are properly validated to avoid performance issues.

What software versions are affected by CVE-2025-6075?

CVE-2025-6075 affects several versions of Microsoft Python distributions, specifically cbl2 and azl3 Python versions.

Is there a known exploit for CVE-2025-6075?

As of now, there are no known exploits specifically targeting CVE-2025-6075, but the vulnerability could be leveraged in denial-of-service scenarios.

What are the potential impacts of CVE-2025-6075?

The primary impact of CVE-2025-6075 is reduced application performance due to inefficient processing of environment variables.

CVE-2025-6075: Quadratic complexity in os.path.expandvars() with user-controlled template

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-6075?

How do I fix CVE-2025-6075?

What software versions are affected by CVE-2025-6075?

Is there a known exploit for CVE-2025-6075?

What are the potential impacts of CVE-2025-6075?

Company

Resources

Contact