VAITP Dataset

← Back to the dataset

CVE-2025-6069

HTMLParser DoS via crafted malformed input, quadratic complexity.

  • CVSS 4.3
  • CWE-1333
  • Resource Management
  • Remote

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

CVSS base score
4.3
Published
2025-06-17
OWASP
A03 Injection
Orthogonal defect classification
Algorithm
Code defect classification
Incorrect Algorithm
Category
Resource Management
Subcategory
Resource Exhaustion
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Affected component
Python
Fixed by upgrading
Yes

Solution

Upgrade to Python 3.7.4+, 3.6.9+, or 2.7.17+.

Vulnerable code sample

import html.parser

class QuadraticHTMLParser(html.parser.HTMLParser):
    def handle_starttag(self, tag, attrs):
        pass

    def handle_endtag(self, tag):
        pass

    def handle_data(self, data):
        pass

# Example of a potentially vulnerable input (before fix).  This crafted input aims to trigger the quadratic complexity.
# The exact triggering conditions are complex and dependent on the internal implementation of HTMLParser.

def process_html(html_content):
    parser = QuadraticHTMLParser()
    parser.feed(html_content)
    parser.close()


if __name__ == '__main__':
    # Generate a potentially problematic HTML string (very long sequence of angle brackets and specific tag structures).

    long_string = "<A" * 10000 + ">" * 10000  #Repeated <A> tags can lead to quadratic behavior in certain parser implementations.
    # The actual triggering input is far more complex and implementation-dependent

    process_html(long_string) #This might cause performance issues depending on the version of HTMLParser

    print("Finished processing HTML (potentially slowly).")

Patched code sample

import html.parser
import sys

class SafeHTMLParser(html.parser.HTMLParser):
    def __init__(self, *args, max_input_length=100000, **kwargs):
        super().__init__(*args, **kwargs)
        self.max_input_length = max_input_length
        self.data_buffer = []

    def feed(self, data):
        if len(data) > self.max_input_length:
            raise ValueError(f"Input exceeds maximum allowed length of {self.max_input_length}")
        super().feed(data)

    def handle_starttag(self, tag, attrs):
        # Process start tag.  This example limits the number of attributes.
        if len(attrs) > 10:  # Example limit: max 10 attributes
            raise ValueError("Too many attributes in start tag")
        # Additional tag-specific handling and length checks for attribute values can be implemented here.
        # Example: limit length of attribute values
        for attr_name, attr_value in attrs:
            if len(attr_value) > 200: # Example limit: max length of 200 for attribute value
                raise ValueError(f"Attribute value for {attr_name} too long")

    def handle_data(self, data):
        # Process data within tags. This addresses potential exponential behavior when constructing the data string
        self.data_buffer.append(data)
        if sum(len(s) for s in self.data_buffer) > self.max_input_length:
             raise ValueError("Data content exceeds maximum allowed length")

    def close(self):
        # Process accumulated data efficiently
        full_data = "".join(self.data_buffer)
        # Do something with full_data, e.g., check against a blacklist
        if len(full_data) > self.max_input_length:
            raise ValueError("Processed data exceeds maximum allowed length after combination.")
        super().close() # ensures closing logic is called.

def safe_parse_html(html_string, max_length=100000):
    """Safely parses HTML with length limits and other constraints."""
    parser = SafeHTMLParser(max_input_length=max_length)
    try:
        parser.feed(html_string)
        parser.close()
    except ValueError as e:
        print(f"Parsing error: {e}", file=sys.stderr)
        return None  # Or raise the exception, depending on desired behavior
    except Exception as e:
        print(f"Unexpected parsing error: {e}", file=sys.stderr)
        return None # Or raise
    return parser # return the parser if you want to inspect its attributes.  Otherwise, return relevant data

Payload

<!DOCTYPE html>
<html>
<head>
<title>Quadratic Complexity</title>
</head>
<body>
<!-- Nested comments with overlapping and unterminated comments -->
<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--
</body>
</html>

Cite this entry

@misc{vaitp:cve20256069,
  title        = {{HTMLParser DoS via crafted malformed input, quadratic complexity.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-6069},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-6069/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::