Denial-of-Service Vulnerability in Python HTML Parser - CVE-2025-6069
Summary
UBUNTU-CVE-2025-6069: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. Affects python2.7 versions 2.7.5-8ubuntu3 – 2.7.6-8ubuntu0.6+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python HTML Parser is a built-in library in Python that provides a simple and efficient way to parse HTML documents. It is widely used in web applications for processing HTML content. This library is designed to handle various HTML formats and is essential for developers working with web data. However, it has been found to have a vulnerability that can lead to denial-of-service attacks when processing certain malformed inputs.
Vulnerability Detail
The vulnerability identified as CVE-2025-6069 arises from the html.parser.HTMLParser class, which exhibits worst-case quadratic complexity when handling specific crafted malformed inputs. This can lead to significant performance degradation, causing the application to become unresponsive or crash. The vulnerability is particularly concerning for applications that rely heavily on HTML parsing, as it can be exploited by attackers to disrupt service availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out potentially malicious HTML content before it is processed by the HTML parser. This can help reduce the risk of denial-of-service attacks while a permanent fix is being applied.
Conclusion
CVE-2025-6069 presents a significant risk for applications utilizing the Python HTML Parser, potentially leading to denial-of-service conditions. It is crucial for developers to update their packages and implement input validation as a workaround to safeguard their applications against exploitation.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2025-6069 is a vulnerability in the Python HTML Parser that can lead to denial-of-service attacks due to its quadratic complexity when processing certain malformed inputs.
If your application uses the Python HTML Parser, it may become unresponsive or crash when handling specially crafted HTML inputs, leading to service disruptions.
The vulnerability affects multiple versions of Python, including Python 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, and 3.11.
Yes, patches are available for the affected Python packages. It is recommended to update to the latest versions to mitigate the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
