The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

ubuntu_linux USN-7710-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 25.04 : Python vulnerabilities (USN-7710-1)

suse_linux SUSE-SU-2025:02778-1: SUSE SLED15 / SLES15 / openSUSE 15 : Security update for python3 (Important) (SUSE-SU-2025:02778-1)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02802-1 advisory.

    - CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705)
    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249)

    Other fixes:
    - Limit buffer size for IPv6 address parsing (bsc#1244401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02767-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).
    - CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02717-1 advisory.

    - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).
    - CVE-2025-4435: Fixed Tarfile extracting filtered members when errorlevel=0 (bsc#1244061).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6069 advisory.

  - The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1116 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1090 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02597-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02523-1 advisory.

    - CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02460-1 advisory.

    - CVE-2025-6069: Fixed worst case quadratic complexity that can lead to amplified DoS. (bsc#1244705)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1941db8ecb advisory.

    Backport fix for CVE-2025-6069.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c871432bf3 advisory.

    Backport fix for CVE-2025-6069.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02359-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6069 advisory.

  - The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02358-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02297-1 advisory.

    - CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside     extraction directory (bsc#1244056)
    - CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory,     and the modification of some file metadata (bsc#1244059)
    - CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory     (bsc#1244060)
    - CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
    - CVE-2025-4516: Fixed denial of service due to DecodeError handling vulnerability (bsc#1243273)
    - CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with     filter='data' (bsc#1244032)
    - CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705)

    Other fixes:
    - Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15       migration (bsc#1233012)
    - Update vendored ipaddress module to 3.8 equivalent
    - Limit buffer size for IPv6 address parsing (bsc#1244401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2911 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1056 advisory.

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2923 advisory.

    There is an issue in CPython when using `bytes.decode(unicode_escape, error=ignore|replace)`. If you     are not using the unicode_escape encoding or an error handler your usage is not affected. To work-around     this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except     catching the DecodeError. (CVE-2025-4516)

    The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted     malformed inputs potentially leading to amplified denial-of-service. (CVE-2025-6069)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02232-1 advisory.

    - CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs     with HTMLParser (bsc#1244705).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
252055	Linux Distros Unpatched Vulnerability : CVE-2025-6069	Nessus	Misc.	medium
250268	SUSE SLES12 Security Update : python3 (SUSE-SU-2025:02802-1)	Nessus	SuSE Local Security Checks	medium
249226	SUSE SLED15 / SLES15 Security Update : python313 (SUSE-SU-2025:02767-1)	Nessus	SuSE Local Security Checks	high
244839	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2025:02717-1)	Nessus	SuSE Local Security Checks	high
244823	Azure Linux 3.0 Security Update: python3 (CVE-2025-6069)	Nessus	Azure Linux Local Security Checks	medium
243495	Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-1116)	Nessus	Amazon Linux Local Security Checks	medium
243488	Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-1090)	Nessus	Amazon Linux Local Security Checks	medium
243302	openSUSE 15 Security Update : python310 (SUSE-SU-2025:02597-1)	Nessus	SuSE Local Security Checks	medium
242863	SUSE SLES12 Security Update : python (SUSE-SU-2025:02523-1)	Nessus	SuSE Local Security Checks	medium
242605	SUSE SLES15 / openSUSE 15 Security Update : python (SUSE-SU-2025:02460-1)	Nessus	SuSE Local Security Checks	medium
242498	Fedora 41 : mingw-python3 (2025-1941db8ecb)	Nessus	Fedora Local Security Checks	medium
242494	Fedora 42 : mingw-python3 (2025-c871432bf3)	Nessus	Fedora Local Security Checks	medium
242374	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2025:02359-1)	Nessus	SuSE Local Security Checks	medium
242365	CBL Mariner 2.0 Security Update: python3 (CVE-2025-6069)	Nessus	MarinerOS Local Security Checks	medium
242307	SUSE SLES15 Security Update : python311 (SUSE-SU-2025:02358-1)	Nessus	SuSE Local Security Checks	medium
242011	SUSE SLES12 Security Update : python36 (SUSE-SU-2025:02297-1)	Nessus	SuSE Local Security Checks	critical
241750	Amazon Linux 2 : python (ALAS-2025-2911)	Nessus	Amazon Linux Local Security Checks	medium
241739	Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1056)	Nessus	Amazon Linux Local Security Checks	medium
241738	Amazon Linux 2 : python3 (ALAS-2025-2923)	Nessus	Amazon Linux Local Security Checks	medium
241510	openSUSE 15 Security Update : python39 (SUSE-SU-2025:02232-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-6069

medium

Tenable Plugins

Coming Soon

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium