{"id":"CVE-2025-6069","title":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.","summary":"The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-1333"],"published":"2025-06-17","updated":"2026-07-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069","references":[{"url":"https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15","label":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/135462","label":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/135464","label":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/","label":"cna@python.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6069.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-6069"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373234"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6069"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6069"},{"url":"https://access.redhat.com/errata/RHSA-2025:23530"},{"url":"https://access.redhat.com/errata/RHSA-2026:74087"},{"url":"https://access.redhat.com/errata/RHSA-2025:23342"},{"url":"https://access.redhat.com/errata/RHSA-2026:1858"},{"url":"https://access.redhat.com/errata/RHSA-2026:1652"},{"url":"https://access.redhat.com/errata/RHSA-2026:0414"},{"url":"https://access.redhat.com/errata/RHSA-2026:0685"},{"url":"https://access.redhat.com/errata/RHSA-2026:76945"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00603,"epssPercentile":0.48651,"ingestedAt":"2026-07-31T06:58:50.948Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_v_9","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_v_9","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","ceph_storage 7","ceph_storage 8","discovery 2","update_infrastructure 5"],"patched":["enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_v_9","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_v_9","enterprise_linux_crb_v_8","enterprise_linux_codeready_linux_builder_v_9","ceph_storage 7","ceph_storage 8","discovery 2","update_infrastructure 5"],"slug":"CVE-2025-6069","body":"## Overview\n\nThe html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2025:23530** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2025-12-18 · [advisory](https://access.redhat.com/errata/RHSA-2025:23530)\n- **RHSA-2026:74087** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4) · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74087)\n- **RHSA-2025:23342** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2025-12-18 · [advisory](https://access.redhat.com/errata/RHSA-2025:23342)\n- **RHSA-2026:1858** · Red Hat · fixed in: Red Hat Ceph Storage 7 · released 2026-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:1858)\n- **RHSA-2026:1652** · Red Hat · fixed in: Red Hat Ceph Storage 8 · released 2026-02-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:1652)\n- **RHSA-2026:0414** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0414)\n- **RHSA-2026:0685** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-01-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:0685)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6069.json)\n- **RHSA-2026:76945** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76945)","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}