CVE-2025-6069
HTMLParser DoS via crafted malformed input, quadratic complexity.
- CVSS 4.3
- CWE-1333
- Resource Management
- Remote
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
- CWE
- CWE-1333
- CVSS base score
- 4.3
- Published
- 2025-06-17
- OWASP
- A03 Injection
- Orthogonal defect classification
- Algorithm
- Code defect classification
- Incorrect Algorithm
- Category
- Resource Management
- Subcategory
- Resource Exhaustion
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Affected component
- Python
- Fixed by upgrading
- Yes
Solution
Upgrade to Python 3.7.4+, 3.6.9+, or 2.7.17+.
Vulnerable code sample
import html.parser
class QuadraticHTMLParser(html.parser.HTMLParser):
def handle_starttag(self, tag, attrs):
pass
def handle_endtag(self, tag):
pass
def handle_data(self, data):
pass
# Example of a potentially vulnerable input (before fix). This crafted input aims to trigger the quadratic complexity.
# The exact triggering conditions are complex and dependent on the internal implementation of HTMLParser.
def process_html(html_content):
parser = QuadraticHTMLParser()
parser.feed(html_content)
parser.close()
if __name__ == '__main__':
# Generate a potentially problematic HTML string (very long sequence of angle brackets and specific tag structures).
long_string = "<A" * 10000 + ">" * 10000 #Repeated <A> tags can lead to quadratic behavior in certain parser implementations.
# The actual triggering input is far more complex and implementation-dependent
process_html(long_string) #This might cause performance issues depending on the version of HTMLParser
print("Finished processing HTML (potentially slowly).")Patched code sample
import html.parser
import sys
class SafeHTMLParser(html.parser.HTMLParser):
def __init__(self, *args, max_input_length=100000, **kwargs):
super().__init__(*args, **kwargs)
self.max_input_length = max_input_length
self.data_buffer = []
def feed(self, data):
if len(data) > self.max_input_length:
raise ValueError(f"Input exceeds maximum allowed length of {self.max_input_length}")
super().feed(data)
def handle_starttag(self, tag, attrs):
# Process start tag. This example limits the number of attributes.
if len(attrs) > 10: # Example limit: max 10 attributes
raise ValueError("Too many attributes in start tag")
# Additional tag-specific handling and length checks for attribute values can be implemented here.
# Example: limit length of attribute values
for attr_name, attr_value in attrs:
if len(attr_value) > 200: # Example limit: max length of 200 for attribute value
raise ValueError(f"Attribute value for {attr_name} too long")
def handle_data(self, data):
# Process data within tags. This addresses potential exponential behavior when constructing the data string
self.data_buffer.append(data)
if sum(len(s) for s in self.data_buffer) > self.max_input_length:
raise ValueError("Data content exceeds maximum allowed length")
def close(self):
# Process accumulated data efficiently
full_data = "".join(self.data_buffer)
# Do something with full_data, e.g., check against a blacklist
if len(full_data) > self.max_input_length:
raise ValueError("Processed data exceeds maximum allowed length after combination.")
super().close() # ensures closing logic is called.
def safe_parse_html(html_string, max_length=100000):
"""Safely parses HTML with length limits and other constraints."""
parser = SafeHTMLParser(max_input_length=max_length)
try:
parser.feed(html_string)
parser.close()
except ValueError as e:
print(f"Parsing error: {e}", file=sys.stderr)
return None # Or raise the exception, depending on desired behavior
except Exception as e:
print(f"Unexpected parsing error: {e}", file=sys.stderr)
return None # Or raise
return parser # return the parser if you want to inspect its attributes. Otherwise, return relevant dataPayload
<!DOCTYPE html>
<html>
<head>
<title>Quadratic Complexity</title>
</head>
<body>
<!-- Nested comments with overlapping and unterminated comments -->
<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--<!--
</body>
</html>
Cite this entry
@misc{vaitp:cve20256069,
title = {{HTMLParser DoS via crafted malformed input, quadratic complexity.
}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2025},
note = {VAITP Python Vulnerability Dataset, entry CVE-2025-6069},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-6069/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::
