Security readout for executives and security teams
Plain-English summary
Malformed HTML can make Python’s built-in HTML parser perform disproportionately expensive work, potentially slowing or disrupting a service. The issue affects availability, not data confidentiality or integrity. Risk is greatest where applications parse attacker-influenced HTML.
Executive priority
Schedule remediation through normal vulnerability management, accelerating internet-facing or high-volume services that parse user-controlled HTML. Confirm exposure before treating this as an emergency; current evidence supports availability risk but not active exploitation.
Technical view
CVE-2025-6069 is a CWE-1333 algorithmic-complexity issue in html.parser.HTMLParser. Certain malformed inputs trigger worst-case quadratic processing, enabling amplified denial of service. CVSS 3.1 is 4.3: network-accessible, low complexity, low privileges, no user interaction, and low availability impact.
Likely exposure
Potentially exposed systems use affected CPython versions and pass network-supplied or otherwise untrusted HTML into HTMLParser. The supplied version data does not clearly establish complete affected ranges or exact fixed releases, so deployments require vendor-specific verification.
Exploitation context
The bundle does not establish active exploitation, and the CVE is not listed as KEV. Exploitation requires low privileges according to the CVSS vector. Successful abuse may consume excessive processing time, but no confidentiality or integrity impact is identified.
Researcher notes
The referenced issue, pull request, and commits document upstream correction work. However, the supplied bundle does not map each commit to a complete affected or fixed release matrix. Researchers should preserve that uncertainty and consult the Python advisory or distributor notices for branch-specific status.
Mitigation direction
- Identify services that parse untrusted HTML using html.parser.HTMLParser.
- Upgrade to a supported CPython build incorporating the referenced upstream patches.
- Confirm exact fixed package versions through Python or operating-system distributor guidance.
- Temporarily reduce untrusted HTML exposure where upgrades cannot be completed promptly.
Validation and detection
- Inventory deployed Python versions and applications invoking HTMLParser.
- Trace whether authenticated or network-originated HTML can reach the parser.
- Confirm installed packages contain an upstream fix or documented vendor backport.
- Run vendor-approved regression tests in staging and monitor parser latency and CPU usage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1333: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-6069 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L2.81.4PSFVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/issues/135462CVE reference, PSF · issue-tracking
- https://github.com/python/cpython/pull/135464CVE reference, PSF · patch
- https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949CVE reference, PSF · patch
- https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41CVE reference, PSF · patch
- https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4bCVE reference, PSF · patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49CVE reference, PSF · patch
- https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5CVE reference, PSF · patch
- https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fcCVE reference, PSF · patch
- https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15CVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inefficient Regular Expression Complexity
Inefficient Regular Expression Complexity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.