CVE-2025-12084

24

FAUCET Score

CVE-2025-12084 describes a quadratic algorithm vulnerability in Python's xml.dom.minidom when building excessively nested XML elements, potentially leading to denial of service due to impacted availability. This vulnerability, rated Medium with a CVSS score of 5.3, can be exploited remotely with low attack complexity and no user interaction required. While the FAUCET Risk Score is 75/100, there is currently no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing. Community discussion is minimal, with only one mention, and no media coverage has been observed.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 0, < 3.10.20CPE match	cpe:2.3:a:python:python::::::::
		>= 3.11.0, < 3.11.15CPE match	cpe:2.3:a:python:python::::::::
		>= 3.12.0, < 3.12.13CPE match	cpe:2.3:a:python:python::::::::
		>= 3.13.0, < 3.13.11CPE match	cpe:2.3:a:python:python::::::::
		>= 3.14.0, < 3.14.2CPE match	cpe:2.3:a:python:python::::::::

CVSS Data

CVSS version used by this source: 4.0

6.3MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

PRESENT

Privileges Required

NONE

User Interaction

NONE

VS Confidentiality

NONE

VS Integrity

NONE

VS Availability

LOW

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

NONE

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

0.71%

Probability of exploitation in next 30 days

EPSS Percentile

49.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0071 is in the 31st percentile among its peer group of 23,725 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (53)

github_advisorypatch availablevia nvd_reference

hashicorppatch availablevia llm_extracted

microsoftpatch availablevia msrc

Product: cbl2 python3 3.9.19-18 on CBL Mariner 2.0Fixed in: 3.9.19-19

microsoftpatch availablevia msrc

Product: azl3 python3 3.12.9-6 on Azure Linux 3.0Fixed in: 3.12.9-7

microsoftpatch availablevia msrc

Product: azl3 python3 3.12.9-7 on Azure Linux 3.0Fixed in: 3.12.9-7

microsoftpatch availablevia msrc

Product: 20916-17086Fixed in: 3.9.19-19

microsoftpatch availablevia msrc

Product: 20708-17084Fixed in: 3.12.9-7

microsoftpatch availablevia msrc

Product: 20790-17084Fixed in: 3.12.9-7

microsoftpatch availablevia msrc

Product: 20937-17086Fixed in: 3.9.19-19

microsoftpatch availablevia msrc

Product: cbl2 python3 3.9.19-19 on CBL Mariner 2.0Fixed in: 3.9.19-19

puppetpatch availablevia llm_extracted

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: python3-0:3.6.8-47.el8_6.10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: python3-0:3.6.8-47.el8_6.10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: python3-0:3.6.8-47.el8_6.10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: python3.11-0:3.11.2-2.el8_8.7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: python3-0:3.6.8-51.el8_8.12

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: python3.11-0:3.11.2-2.el8_8.7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: python3-0:3.6.8-51.el8_8.12

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: python3.12-0:3.12.12-4.el9_7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: python3.11-0:3.11.13-5.el9_7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: python3.9-0:3.9.25-3.el9_7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: python3.9-0:3.9.10-4.el9_0.8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: python3.11-0:3.11.2-2.el9_2.9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: python3.9-0:3.9.16-1.el9_2.11

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: python3.12-0:3.12.1-4.el9_4.9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: python3.11-0:3.11.7-1.el9_4.10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: python3.9-0:3.9.18-3.el9_4.10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: python3.12-0:3.12.9-1.el9_6.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: python3.11-0:3.11.11-2.el9_6.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: python3.9-0:3.9.21-2.el9_6.3

redhatpatch availablevia redhat_api

Product: Red Hat Discovery 2Fixed in: discovery/discovery-server-rhel9:sha256:d4d6cd6b1a84587ee851c4f76b47c1e6bf9f597f4a476c34e4a257cd1a860448

redhatpatch availablevia redhat_api

Product: Red Hat Discovery 2Fixed in: discovery/discovery-ui-rhel9:sha256:26bb49a8e2e695d61192f04eb0db63efa8210bba20ea22b60e4e22d519d8b9e6

redhatpatch availablevia redhat_api

Product: Red Hat Update Infrastructure 5Fixed in: rhui5/installer-rhel9:sha256:48cf7cf48dfadb17f9357bf1894a5d0393551a893faa8b0ea0e11fe1ffed497f

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10Fixed in: python3.12-0:3.12.12-3.el10_1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10.0 Extended Update SupportFixed in: python3.12-0:3.12.9-2.el10_0.6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: python-0:2.7.5-94.el7_9.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: python3-0:3.6.8-21.el7_9.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python3.12-0:3.12.12-1.el8_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python3.11-0:3.11.13-4.el8_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: python3-0:3.6.8-72.el8_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: python3-0:3.6.8-24.el8_2.5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: python3-0:3.6.8-39.el8_4.8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: python3-0:3.6.8-39.el8_4.8

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-gcp-cuda-rhel9

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-cuda-rhel9

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-azure-cuda-rhel9

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI) 3Fixed in: rhelai3/bootc-aws-cuda-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-nvidia-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-gcp-nvidia-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-azure-nvidia-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-azure-amd-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-aws-nvidia-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-amd-rhel9

Vendor Advisories (4)

puppetllm-puppet-6fb008c4e00001d4

USN-8018-3: Python 2.7 vulnerabilities

hashicorpllm-hashicorp-e1fb8ae78f74759d

USN-8018-3: Python 2.7 vulnerabilities

microsoft2025-Dec/CVE-2025-12084Moderate

Quadratic complexity in node ID cache clearing

redhatCVE-2025-12084Moderate

cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service

References

github.com / python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0

Patch

github.com / python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4

Patch

github.com / python/cpython/commit/27648a1818749ef44c420afe6173af6868715437

github.com / python/cpython/commit/41f468786762348960486c166833a218a0a436af

github.com / python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273

github.com / python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907

github.com / python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d

github.com / python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8

github.com / python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8

github.com / python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0

github.com / python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964

Patch

github.com / python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53

github.com / python/cpython/issues/142145

Issue TrackingPatch

github.com / python/cpython/pull/142146

Issue TrackingPatch