CVE-2025-6069

Published Jun 17, 2025

Last updated 3 months ago

CVSS medium 4.3
Database

Overview

Description
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
Source
cna@python.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
4.3
Impact score
1.4
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Severity
MEDIUM

Weaknesses

cna@python.org
CWE-1333

Social media

Hype score
Not currently trending

  1. Critical #Python310 update! Patch CVE-2025-6069 on openSUSE Leap 15.4/15.6: ✅ Prevents CPU-exhaustion attacks ✅ Fixes HTMLParser vulnerability ✅ Commands: 15.4 → zypper in -t patch SUSE-2025-2597=1 Read more: 👉 https://t.co/G1KrtoX723 https://t.co/m9

    @Cezar_H_Linux

    3 Aug 2025

    40 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2025-6069 The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. https://t.co/pJhXBzjiZC

    @CVEnew

    17 Jun 2025

    133 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.•CVE-2026-54313
  2. PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions•CVE-2026-11945
  3. Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability•CVE-2026-35273
  4. Splunk Enterprise Missing Authentication for Critical Function Vulnerability•CVE-2026-20253
  5. Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. While the vulnerability is in Net Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Net Service. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).•CVE-2026-46833

References

Sources include official advisories and independent security research.