CVE-2025-12084: Quadratic complexity in node ID cache clearing
Quadratic complexity in node ID cache clearing
Other sources
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on clearidcache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
— NVD
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12084?
CVE-2025-12084 has the potential to significantly impact availability due to its quadratic algorithm when processing excessively nested documents.
How do I fix CVE-2025-12084?
Fixing CVE-2025-12084 involves updating to the latest version of Python's xml.dom.minidom which includes optimizations for handling nested elements.
What is the impact of CVE-2025-12084?
CVE-2025-12084 can lead to performance issues or application crashes when dealing with deeply nested XML documents.
Which versions of Python xml.dom.minidom are affected by CVE-2025-12084?
CVE-2025-12084 affects all versions of Python xml.dom.minidom that utilize the vulnerable appendChild() methods.
Is CVE-2025-12084 easily exploitable?
CVE-2025-12084 is primarily a performance-based issue and is not directly exploitable in a security context, but it can degrade application functionality.