CVE-2025-12084: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-12084 is a denial-of-service vulnerability in Python's xml.dom.minidom standard library module caused by quadratic algorithmic complexity in the _clear_id_cache() function. When building deeply nested XML documents using methods such as appendChild(), the _in_document() helper traversed the entire ancestor chain on every call, resulting in O(n²) behavior. The vulnerability was reported on December 1, 2025, and publicly disclosed on December 3, 2025, with patches merged the same day. It affects CPython versions prior to 3.13.11 and 3.14.0–3.14.1 (fixed in 3.14.2), as well as 3.15.0-alpha1 and alpha2. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (CPython Issue, CPython PR, Microsoft MSRC).

The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity). The _clear_id_cache() function in Lib/xml/dom/minidom.py called the helper _in_document(node), which walked the full parent chain from the current node to the document root to determine if a node was part of a document tree. When appendChild() is called repeatedly to build a deeply nested structure (e.g., a chain of 2^15 elements), each call triggers _clear_id_cache(), which in turn traverses an ever-growing ancestor chain — resulting in quadratic time complexity. The fix replaced the _in_document() traversal with a direct check of node.ownerDocument, reducing the operation to O(1) per call. The vulnerability is network-reachable (AV:N) with no authentication required, making it exploitable by any remote party that can supply XML input to an affected application (CPython Commit, CPython PR).

Successful exploitation causes a denial of service through excessive CPU consumption. An attacker who can supply a crafted XML document with deeply nested elements to an application using xml.dom.minidom can cause the processing thread to stall for tens of seconds or longer — a test case with 2^15 nested elements previously took over 30 seconds to process. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Applications that parse untrusted XML using xml.dom.minidom and build nested DOM trees are at risk of becoming unresponsive or crashing under sustained attack (CPython Commit, CPython Issue).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.04%, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. While no authentication or user interaction is required, exploitation requires the attacker to control or influence XML input processed by a vulnerable application, which limits the practical attack surface (CPython Issue, Microsoft MSRC).

1. Reconnaissance: Identify applications that accept XML input and process it using Python's xml.dom.minidom library (e.g., web services, APIs, document processors).
2. Craft malicious XML: Construct an XML document with an extremely deep nesting of elements — for example, a chain of 32,768 (2^15) or more nested child elements.
3. Submit the payload: Send the crafted XML document to the target application via the relevant input channel (HTTP request body, file upload, API call, etc.).
4. Trigger quadratic processing: The application parses the XML using xml.dom.minidom and calls appendChild() iteratively, causing _clear_id_cache() → _in_document() to traverse the full ancestor chain on each call, consuming CPU time quadratically.
5. Achieve denial of service: The processing thread becomes blocked for an extended period (30+ seconds for 2^15 elements), potentially causing application timeouts, thread pool exhaustion, or service unavailability (CPython Commit, CPython PR).

• Logs: Application logs showing unusually long XML processing times or request timeouts when handling XML input; Python stack traces referencing xml/dom/minidom.py functions _clear_id_cache or _in_document.
• Process: Python processes consuming sustained high CPU (near 100%) for extended periods while processing XML documents; worker threads or processes becoming unresponsive.
• Network: Repeated submissions of large or deeply nested XML payloads from the same source IP; XML payloads with abnormally high depth-to-size ratios in HTTP request bodies or file uploads.

The fix is included in Python 3.13.11 and 3.14.2, released on December 5–6, 2025. Backports were also applied to the 3.10, 3.11, and 3.12 branches. Upgrading to a patched Python release is the primary recommended remediation. As a workaround for applications that cannot be immediately upgraded: validate and restrict XML input depth and size before processing; avoid using xml.dom.minidom for untrusted XML in favor of more efficient parsers (e.g., xml.etree.ElementTree); and implement request-level timeouts and resource limits to bound the impact of slow XML processing. Downstream distributions including Red Hat, Ubuntu, Debian, SUSE, Fedora, and IBM products have issued their own security advisories and updated packages (CPython PR, Python Blog).

The fix was authored by Seth Michael Larson (Python Security Developer-in-Residence) and merged by Gregory P. Smith on December 3, 2025, the same day as disclosure. The Python Software Foundation released Python 3.13.11 and 3.14.2 shortly after to address this and related issues. The initial fix caused a regression in some downstream software (e.g., skosprovider) due to behavioral changes in DOM node handling, prompting a follow-up fix in CPython PR #142794. The vulnerability received broad coverage across Linux distribution security channels (Red Hat, Ubuntu, Debian, SUSE, Fedora, IBM) and was discussed in the oss-security mailing list (CPython PR, Python Blog, oss-sec).