CVE-2025-6069
📋 TL;DR
This CVE describes a denial-of-service vulnerability in Python's html.parser.HTMLParser class where specially crafted malformed HTML inputs can trigger worst-case quadratic time complexity, causing excessive CPU consumption. This affects any Python application using html.parser to parse untrusted HTML input. The vulnerability could allow attackers to cause service degradation or complete unavailability.
💻 Affected Systems
- Python
- Any application using Python's html.parser module
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting multiple services on the same host
Likely Case
Service degradation with increased response times and reduced throughput
If Mitigated
Minimal impact with proper input validation and resource limits in place
🎯 Exploit Status
Exploitation requires sending specially crafted malformed HTML to a vulnerable parser
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Python versions containing the referenced commits
Vendor Advisory: https://github.com/python/cpython/security/advisories
Restart Required: Yes
Instructions:
1. Update Python to version containing the fix commits
2. Restart affected Python applications
3. Test HTML parsing functionality after update
🔧 Temporary Workarounds
Input validation and sanitization
allValidate and sanitize HTML input before parsing to prevent malformed content
Resource limiting
allImplement CPU time limits and request timeouts for HTML parsing operations
🧯 If You Can't Patch
- Implement strict input validation to reject malformed HTML
- Deploy rate limiting and request throttling to prevent DoS attacks
🔍 How to Verify
Check if Vulnerable:
Check if application uses html.parser.HTMLParser and processes untrusted HTML inputCheck Version:
python --versionVerify Fix Applied:
Verify Python version includes the fix commits or test with known malformed HTML payloads📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage by Python processes
- Increased HTML parsing times
- Request timeouts on HTML processing endpoints
Network Indicators:
- Repeated requests with malformed HTML content
- Traffic patterns suggesting DoS attempts
SIEM Query:
source="application_logs" AND (process="python" AND cpu_usage>90% AND duration>30s)🔗 References
- https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949
- https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41
- https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49
- https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5
- https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b
- https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc
- https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15
- https://github.com/python/cpython/issues/135462
- https://github.com/python/cpython/pull/135464
- https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/
