Security readout for executives and security teams
Plain-English summary
CVE-2025-6075 can make Python spend disproportionate processing time expanding environment variables in a user-controlled template. The documented impact is reduced availability, not data theft or modification. With a CVSS 4.0 score of 1.8 and demanding access conditions, this is a low-severity resource-exhaustion issue.
Executive priority
Treat as planned, low-priority remediation unless business-critical workloads expose this function to controllable input. Accelerate patching where repeated submissions could consume constrained processing capacity. No confidentiality or integrity impact is identified in the supplied assessment.
Technical view
CPython's os.path.expandvars() can exhibit quadratic complexity when processing a user-controlled template, creating CWE-400 resource consumption. The supplied CVSS vector describes local access, low attack complexity, an additional prerequisite, high privileges, no user interaction, and low availability impact. CPython provides multiple patch references, but the bundle does not map each commit to a fixed release.
Likely exposure
Exposure requires application code to pass user-controlled templates into os.path.expandvars(). Prioritize local tools, automation, or services where highly privileged users can influence these inputs, especially if requests can be repeated or processing resources are constrained. Merely running Python does not establish exposure.
Exploitation context
The source bundle reports no CISA KEV listing and provides no evidence of active exploitation. The CVSS assessment requires local access, high privileges, and an additional prerequisite. These constraints substantially limit practical risk, although reachable processing paths could still suffer performance degradation.
Researcher notes
The affected-version data is unusually broad and includes a value of "0" alongside CPython branches through 3.15.0a1. The bundle lists seven remediation commits but does not associate them with specific fixed releases. Validate exact branch and release status against the Python advisory before declaring a deployment vulnerable or remediated.
Mitigation direction
- Identify applications passing user-controlled strings to os.path.expandvars().
- Apply the appropriate CPython security update after confirming the fixed release with vendor guidance.
- Restrict template input length and accepted syntax where immediate upgrading is unavailable.
- Limit repeated processing and monitor resource consumption around exposed template-expansion paths.
Validation and detection
- Inventory deployed CPython versions and compare them with current vendor guidance.
- Search application code for os.path.expandvars() calls receiving user-controlled data.
- Confirm exposed callers enforce suitable input and repetition limits.
- After updating, run controlled performance regression tests using non-production resources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-6075 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 1.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
1.8LowVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/issues/136065CVE reference, PSF · issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8cCVE reference, PSF · patch
- https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84CVE reference, PSF · patch
- https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebcaCVE reference, PSF · patch
- https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742CVE reference, PSF · patch
- https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1baCVE reference, PSF · patch
- https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5cCVE reference, PSF · patch
- https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427CVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.