CVE-2025-6075

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description A performance degradation issue exists in the os.path.expandvars() function. When the function processes specially crafted, user-controlled input containing nested environment variable patterns, it exhibits quadratic time complexity. This can lead to excessive CPU usage and a denial of service (DoS) condition. The impact is limited to performance slowdown, as no code execution or data exposure occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid passing user-controlled input to the os.path.expandvars() function.