PT-2025-48982 · Python+9 · Xml.Dom.Minidom+9

Jacob Walls + 3 · Published 2025-12-01 · Updated 2026-05-11 · CVE-2025-12084

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions xml.dom.minidom (affected versions not specified)

Description The software experiences a performance issue when constructing deeply nested XML documents using methods like appendChild(). This is due to a quadratic algorithm within the clear id cache() function, which is triggered when building nested elements. This can lead to availability impacts when processing excessively complex documents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-407

Related Identifiers

ALSA-2026:0123

ALSA-2026:1374

ALSA-2026:1408

ALSA-2026:1410

ALSA-2026:1478

ALSA-2026:1631

ALSA-2026:1828

AZL-71441

AZL-71450

BDU:2026-01344

BIT-LIBPYTHON-2025-12084

BIT-PYTHON-2025-12084

BIT-PYTHON-MIN-2025-12084

CVE-2025-12084

ECHO-E2C7-423A-BEB2

MGASA-2025-0324

OESA-2026-1052

OESA-2026-1053

OESA-2026-1054

OESA-2026-1055

OESA-2026-1056

OESA-2026-1057

OPENSUSE-SU-2025:15839-1

OPENSUSE-SU-2025:15840-1

OPENSUSE-SU-2025:15846-1

OPENSUSE-SU-2025:15849-1

OPENSUSE-SU-2025:15850-1

OPENSUSE-SU-2025:15851-1

OPENSUSE-SU-2026:10011-1

OPENSUSE-SU-2026:20081-1

PSF-2025-16

RHSA-2026:0123

RHSA-2026:1374

RHSA-2026:1408

RHSA-2026:1410

RHSA-2026:1478

RHSA-2026:1537

RHSA-2026:1558

RHSA-2026:1582

RHSA-2026:1583

RHSA-2026:1620

RHSA-2026:1631

RHSA-2026:1828

RHSA-2026:1892

RHSA-2026:1893

RHSA-2026:1922

RHSA-2026:2084

RHSA-2026:2233

RHSA-2026:2275

RHSA-2026:2276

RHSA-2026:2330

RHSA-2026:2391

RHSA-2026:2392

RHSA-2026:2393

RHSA-2026:2713

RHSA-2026:7443

RHSA-2026:7661

RHSA-2026:8822

RHSA-2026:8824

SUSE-SU-2025:4522-1

SUSE-SU-2025:4538-1

SUSE-SU-2025:4539-1

SUSE-SU-2026:0024-1

SUSE-SU-2026:0025-1

SUSE-SU-2026:0027-1

SUSE-SU-2026:0130-1

SUSE-SU-2026:0133-1

SUSE-SU-2026:0268-1

SUSE-SU-2026:0299-1

SUSE-SU-2026:0314-1

SUSE-SU-2026:1062-1

SUSE-SU-2026:1107-1

SUSE-SU-2026:1117-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:20047-1

SUSE-SU-2026:20125-1

SUSE-SU-2026:20154-1

SUSE-SU-2026:20374-1

SUSE-SU-2026:20768-1

SUSE-SU-2026:20796-1

USN-8018-1

USN-8018-3

Affected Products

Almalinux

Centos

Debian

Ibm Aix

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

Xml.Dom.Minidom

References · 213

• https://github.com/python/cpython/issues/142145 · Patch
• https://github.com/python/cpython/pull/142146 · Patch
• https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53 · Patch
• https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4 · Patch
• https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964 · Patch
• https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8 · Patch
• https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907 · Patch
• https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437 · Patch
• https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0 · Patch
• https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d · Patch
• https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273 · Patch
• https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af · Patch
• https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0 · Patch
• https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8 · Patch
• https://osv.dev/vulnerability/ALSA-2026:1408 · Vendor Advisory