CVE-2025-12084

Published Dec 3, 2025

Last updated 3 months ago

Overview

Description
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Source
cna@python.org
NVD status
Modified
Products
python

Risk scores

CVSS 4.0

Type
Secondary
Base score
6.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
MEDIUM

CVSS 3.1

Type
Primary
Base score
5.3
Impact score
1.4
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity
MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-407

Social media

Hype score
Not currently trending
  1. Just published a deep dive on the #Fedora 42 patch for CVE-2025-12084. It's fascinating (and a little scary) how a quadratic algorithm in xml.dom.minidom can be weaponized into a full-on DoS attack. Read more: 👉https://t.co/I3AuB7UgYJ #Security https://t.co/t5AdmDe6Tr

    @Cezar_H_Linux

    16 Mar 2026

    92 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Critical Python 3.11 patch for #SUSE/#openSUSE. Fixes CVE-2025-12084 (DoS), CVE-2025-13836 (HTTP attack), CVE-2025-13837 (OOM). Patch now: zypper patch. Read more: 👉 https://t.co/fVQpiETgDS #Security https://t.co/6WmUY6Vfz2

    @Cezar_H_Linux

    29 Jan 2026

    61 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. URGENT: Patch #Python 3.11 on #Fedora43 now! CVEs: CVE-2025-13836 (HTTP Client DoS) & CVE-2025-12084 (XML DoS). Read more: 👉 https://t.co/qqmeV8ENhc #Security #Fedora https://t.co/SpyXSgQjzC

    @Cezar_H_Linux

    25 Jan 2026

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Just published a deep dive on #SUSE's critical security advisory (SUSE-SU-2025:4538-1) for CVE-2025-12084. It's more than just a patch note. Read more: 👉 https://t.co/4r8PQEeYOh #Security https://t.co/9zsIVv3t3B

    @Cezar_H_Linux

    1 Jan 2026

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🚨 Attention #Fedora users and Python developers! A critical security update is available for Fedora 42, patching a denial-of-service vulnerability (CVE-2025-12084) in the #MinGW #Python3 package. Read more: 👉 https://t.co/0zKALHMyug https://t.co/YecA5LLYKv

    @Cezar_H_Linux

    23 Dec 2025

    53 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2025-12084: Critical DoS flaw in mingw-python3 impacts Fedora 42 and 43 via quadratic parsing in xml.dom.minidom. Fedora users should apply available fixes promptly. #DoS https://t.co/G4623Z25qX

    @threatcluster

    23 Dec 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-12084 Quadratic complexity in node ID cache clearing https://t.co/k9ogB0p5sL #MicrosoftSecurity #cybersecurity

    @SecQube

    7 Dec 2025

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. 3 CVEs in CPython https://t.co/F9quXztRRL CVE-2025-13836 Excessive read buffering DoS in http.client CVE-2025-13837 Out-of-memory when loading Plist CVE-2025-12084 Quadratic complexity in node ID cache clearing

    @oss_security

    6 Dec 2025

    344 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. CVE-2025-12084 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability… https://t.co/Gxm8o2jO8Q

    @CVEnew

    3 Dec 2025

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations