CVE-2025-6075: Quadratic complexity in os.path.expandvars() with user-controlled template
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
Other sources
Quadratic complexity in os.path.expandvars() with user-controlled template
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6075?
CVE-2025-6075 has a high severity due to potential performance degradation caused by quadratic complexity in user-controlled inputs.
How do I fix CVE-2025-6075?
To mitigate CVE-2025-6075, ensure that user inputs to os.path.expandvars() are properly validated to avoid performance issues.
What software versions are affected by CVE-2025-6075?
CVE-2025-6075 affects several versions of Microsoft Python distributions, specifically cbl2 and azl3 Python versions.
Is there a known exploit for CVE-2025-6075?
As of now, there are no known exploits specifically targeting CVE-2025-6075, but the vulnerability could be leveraged in denial-of-service scenarios.
What are the potential impacts of CVE-2025-6075?
The primary impact of CVE-2025-6075 is reduced application performance due to inefficient processing of environment variables.