CVE-2025-6069

What it actually does

The html.parser.HTMLParser class exhibits worst-case quadratic complexity when processing certain crafted malformed HTML inputs, enabling CPU exhaustion and denial of service.

Why it matters to the business

Applications that parse untrusted HTML with the Python standard library may experience service degradation or outages, increasing operational costs and availability risks across a broad ecosystem of Python deployments.

How an attack unfolds

An attacker identifies an application endpoint that feeds untrusted data into html.parser.HTMLParser, supplies a specially malformed HTML payload engineered to trigger quadratic behavior, and sustains the input to exhaust CPU resources.

How to fix it

Upgrade Python/cpython to the commit 4455cbabf991e202185a25a631af206f60bbc949 or later; rebuild and redeploy affected applications with the patched interpreter.

How to confirm the fix worked

Confirm the running Python interpreter contains commit 4455cbabf991e202185a25a631af206f60bbc949, then execute parsing benchmarks against known quadratic-triggering inputs to verify linear performance.

Typical attack path

1. Locate Python applications or services that invoke html.parser.HTMLParser on external input
2. Craft malformed HTML that forces quadratic parsing paths
3. Transmit the payload via network-accessible interfaces
4. Monitor for resource consumption and repeat submissions to sustain denial of service

How to detect it

Inspect Python process CPU profiles during HTML parsing windows, review application logs for unusually large or malformed HTML submissions coinciding with performance issues, and correlate with network traffic to parser endpoints.

What your security team should do

• Apply the fixed commit 4455cbabf991e202185a25a631af206f60bbc949 immediately to all Python environments
• Audit codebases for direct or indirect use of html.parser on untrusted data
• Consider replacing html.parser with more robust parsers for high-risk inputs
• Establish monitoring for anomalous CPU usage in Python processes handling HTML