CVE-2025-6075
📋 TL;DR
This CVE describes a denial-of-service vulnerability in Python's os.path.expandvars() function. When user-controlled input is passed to this function, an attacker can cause performance degradation by crafting malicious environment variable expansions. This affects any Python application that uses os.path.expandvars() with untrusted input.
💻 Affected Systems
- Python
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion from CPU/memory consumption during malicious expansion.
Likely Case
Performance degradation leading to increased latency, timeouts, or temporary service disruption.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Exploitation requires the application to pass user input to os.path.expandvars(). The vulnerability is in the expansion logic itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in CPython commits referenced in CVE
Vendor Advisory: https://github.com/python/cpython/security/advisories
Restart Required: Yes
Instructions:
1. Update Python to version containing fixes from referenced commits. 2. Restart affected Python applications. 3. Verify no regressions in expandvars() functionality.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize user input before passing to os.path.expandvars()
Limit Expansion Depth
allImplement custom wrapper that limits recursion depth in variable expansion
🧯 If You Can't Patch
- Implement strict input validation for any data passed to os.path.expandvars()
- Monitor system resources and implement rate limiting on affected endpoints
🔍 How to Verify
Check if Vulnerable:
Review code for usage of os.path.expandvars() with user-controlled input. Check Python version against patched commits.Check Version:
python --versionVerify Fix Applied:
Test expandvars() with crafted input that previously caused performance issues. Verify normal operation.📡 Detection & Monitoring
Log Indicators:
- Unusual CPU spikes
- Increased latency in expandvars() calls
- Timeout errors in related functions
Network Indicators:
- Increased response times from affected services
SIEM Query:
search for 'expandvars' in application logs with performance degradation patterns🔗 References
- https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c
- https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427
- https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84
- https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca
- https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742
- https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba
- https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c
- https://github.com/python/cpython/issues/136065
- https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/
