Potential Quadratic Complexity Vulnerabilities in path Modules

@serhiy-storchaka

Bug Description:
A series of simple quadratic complexity vulnerabilities has been identified. After confirmation by CPython's security team, since these DOS vulnerabilities pose a low threat and are relatively tedious to exploit, we can directly initiate requests in issues to seek assistance from the community for fixes.

Vulnerability Locations (All Fixed):

cpython/Lib/posixpath.py

Line 290 in f49a07b

def expandvars(path):
cpython/Lib/ntpath.py

Line 403 in cb8a72b

def expandvars(path):

Repair Status:

Vulnerabilities have been fixed in gh-136065: Fix quadratic complexity in os.path.expandvars() #134952 by @serhiy-storchaka and @Wulian233.

Common Information:

CPython Version: main branch
Operating System: Linux
Credits: Finder is kexinoh (Xiangfan Wu) from QI-ANXIN Technology Research Institute.

Linked PRs

Move to pythongh-136065.

checkextensions is different issue. Even if there is some similarity, there are many important differences (for example, the code contains other bug and is even prone to infinite loop).

yes,i know it. But it seems that it is not part of path,  belongs to part of the tool. This means that input does not come from the user.

…

---Original--- From: "Serhiy ***@***.***> Date: Sat, Jun 28, 2025 18:20 PM To: ***@***.***>; Cc: ***@***.******@***.***>; Subject: Re: [python/cpython] Potential Quadratic Complexity Vulnerabilitiesin `path` Modules (Issue #136065) serhiy-storchaka left a comment (python/cpython#136065) checkextensions is different issue. Even if there is some similarity, there are many important differences (for example, the code contains other bug and is even prone to infinite loop). — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

So please open a different issue for it.

@serhiy-storchaka

I submitted a new issue.
@serhiy-storchaka
#136073

[3.11] pythongh-136065: Fix quadratic complexity in os.path.expandvar…

[3.10] pythongh-136065: Fix quadratic complexity in os.path.expandvar…

[3.14] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

[3.12] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

[3.10] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

[3.13] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

[3.11] gh-136065: Fix quadratic complexity in os.path.expandvars() (G…

This vulnerability has been assigned to CVE-2025-6075 with a "LOW" severity.

@ambv

Given this has been implemented and backported can the issue be closed? (cc: @ambv, @serhiy-storchaka )

pythongh-136065: Fix quadratic complexity in os.path.expandvars() (py…

[CVE-2025-6075] Fix quadratic complexity in os.path.expandvars()

Navigation Menu

Repository navigation

Potential Quadratic Complexity Vulnerabilities in `path` Modules #136065

Linked PRs

7 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Potential Quadratic Complexity Vulnerabilities in path Modules #136065

Description

Linked PRs

Activity

serhiy-storchaka commented on Jun 28, 2025

kexinoh commented on Jun 28, 2025

serhiy-storchaka commented on Jun 28, 2025

kexinoh commented on Jun 28, 2025

7 remaining items

CharlieZhao95 commented on Nov 3, 2025

cmaloney commented on Nov 3, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Potential Quadratic Complexity Vulnerabilities in `path` Modules #136065