CPython Vulnerability in Bytes Decoding - Impacting Python 3.9, 3.11, and 3.13
Summary
CVE-2025-4516: There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). Affects python3 across 8 version ranges.
< 3.11.12-r1
< 8d35fd1b34935221aff23a1ab69a429dd156be77
< 9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e
< 69b4387f78f413e8c47572a85b3478c47eba8142
< 73b3040f592436385007918887b7e2132aa8431f
< 4398b788ffc1f954a2c552da285477d42a571292
< 6279eb8c076d89d3739a6edb393e43c7929b429d
< ab9893c40609935e0d40a6d2a7307ea51aec598b
Fixed in 3.11.12-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CPython is the reference implementation of the Python programming language, widely used for various applications ranging from web development to data analysis. It provides a robust framework for developers, allowing them to write efficient and readable code. However, certain versions of CPython have a vulnerability related to the bytes.decode method, specifically when using the 'unicode_escape' encoding with error handlers.
Vulnerability Detail
The vulnerability arises when using the bytes.decode method with the 'unicode_escape' encoding and an error handler set to 'ignore' or 'replace'. This can lead to unintended behavior or data corruption, as the error handling may not function as expected. If developers are not using this specific encoding or error handler, they are not affected by this issue. The vulnerability is present in Python versions 3.9, 3.11, and 3.13.
How To Fix
Minimum fixed version
3.11.12-r1
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, avoid using the error handler in the bytes.decode method. Instead, wrap the call in a try-except block to catch the DecodeError. Here is an example of how to implement this:
try: decoded_bytes = bytes_data.decode('unicode_escape') except UnicodeDecodeError: # Handle the error appropriately decoded_bytes = '' # or any other fallback mechanism
Conclusion
In summary, the vulnerability in CPython's bytes.decode method poses risks for applications using specific error handlers with 'unicode_escape' encoding. It is crucial for developers to update their Python versions or implement the provided workaround to mitigate potential issues.
See every vulnerability recorded for python3 →
FAQ
The vulnerability is related to the bytes.decode method in CPython when using 'unicode_escape' encoding with certain error handlers.
Python versions 3.9, 3.11, and 3.13 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If updating is not possible, implement the suggested workaround by avoiding the error handler and using a try-except block.
More information can be found in the CVE details and the official Python documentation regarding the bytes.decode method.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
