CVE-2025-12084

Quadratic complexity in node ID cache clearing

Medium · published December 3, 2025

CVSS v4.0
6.3
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00799 · 56.1th percentile
Published
2025-12-03T18:55Z
EPSS history
Timeline
  • 03 DEC 18:55Z
    Quadratic complexity in node ID cache clearing
    cvelistv5