CVE-2025-12781

Name of the Vulnerable Software and Affected Versions Python versions (affected versions not specified)

Description The b64decode(), standard b64decode(), and urlsafe b64decode() functions within the "base64" module incorrectly accept characters "+/" regardless of the altchars parameter. This behavior deviates from newer RFC recommendations, which suggest either dropping unrecognized characters or raising an error. This discrepancy can potentially lead to data integrity issues if an application relies on a custom base64 alphabet that excludes "+/". The issue is not a security flaw in itself but a deviation from current standards that could cause unexpected behavior. The provided patch deprecates the existing behavior, planning to align with the newer RFC recommendations in a future Python version.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.