5.5

CVE-2025-6075: python software foundation cpython Uncontrolled Resource Consumption

CVSS: 5.5v3.1MediumAnalyzed
AliasesSUSE-SU-2026:0337-1UBUNTU-CVE-2025-6075DEBIAN-CVE-2025-6075
Published 31-10-2025Last modified 31-07-2026
Open JSON

Vulnerability summary

CVE-2025-6075 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in python software foundation cpython. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.7% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.15%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 43 · Related 32
DLA-4445-1OPENSUSE-SU-2025:15742-1OPENSUSE-SU-2025:15748-1OPENSUSE-SU-2025:15750-1OPENSUSE-SU-2025:15760-1OPENSUSE-SU-2025:15768-1

Timeline

  1. 31-10-2025
    PublishedVulnerability first disclosed.
  2. 31-07-2026
    Last modifiedVulnerability information updated.

Description

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

CVSS metrics

8 scores · 6 sources · 2 versions

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

+0.01 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu13 products
  • pypy3All versions (No fix recorded)
  • python2.7All versions (No fix recorded) | < 2.7.12-1ubuntu0~16.04.18+esm21
  • python3.10< 3.10.12-1~22.04.12
  • python3.11< 3.11.0~rc1-1~22.04.1~esm6
  • python3.12< 3.12.3-1ubuntu0.9
Chainguard6 products
  • python-3.10< 3.10.19-r2
  • python-3.11< 3.11.14-r2
  • python-3.12< 3.12.12-r2
  • python-3.13< 3.13.9-r2
  • python-3.14< 3.14.0-r8
Wolfi5 products
  • python-3.10< 3.10.19-r2
  • python-3.11< 3.11.14-r2
  • python-3.12< 3.12.12-r2
  • python-3.13< 3.13.9-r2
  • python-3.14< 3.14.0-r8
Debian4 products
  • pypy3All versions (No fix recorded) | < 7.3.21+dfsg-1
  • python3.11< 3.11.2-6+deb12u7
  • python3.13< 3.13.5-2+deb13u1 | < 3.13.11-1
  • python3.14< 3.14.2-1
Opensuse4 products
  • python-base&distro=openSUSE Leap 15.6< 2.7.18-150000.99.1
  • python-doc&distro=openSUSE Leap 15.6< 2.7.18-150000.99.1
  • python315&distro=openSUSE Tumbleweed< 3.15.0~a1-2.1
  • python&distro=openSUSE Leap 15.6< 2.7.18-150000.99.1
Suse2 products
  • python-base&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 2.7.18-150000.99.1
  • python&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 2.7.18-150000.99.1
Python1 product
  • python< 3.9.0 | ≥ 3.13.1, < 3.13.11 | ≥ 3.14.0, < 3.14.1 | 3.15.0:alpha1
Python software foundation1 product
  • cpython< 3.9.25 | ≥ 3.10.0, < 3.10.20 | ≥ 3.11.0, < 3.11.15 | ≥ 3.12.0, < 3.12.13 | ≥ 3.13.0, < 3.13.10 | ≥ 3.14.0, < 3.14.1 | ≥ 3.15.0a1, < 3.15.0a2

8 vendors · 36 products

References

21 links
Show all 21 references