CVE-2025-12084 MEDIUM

CVE-2025-12084: Quadratic complexity in node ID cache clearing

Vendor Python Software Foundation
Product CPython
Published December 3, 2025
Last update March 3, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Key dates

02Disclosure timeline

December 3, 2025 CVE published
March 3, 2026 Record updated