Skip to content

Fix quadratic behavior in the minidom node ID cache (CVE-2025-12084) - #471

Open
ebourg wants to merge 2 commits into
jython:masterfrom
ebourg:minidom-quadratic-complexity
Open

ebourg wants to merge 2 commits into
jython:masterfrom
ebourg:minidom-quadratic-complexity

Conversation

@ebourg

@ebourg ebourg commented Nov 10, 2026

Copy link
Copy Markdown

Hi,

This PR backports the CPython fix for CVE-2025-12084 with its test:

sethmlarson and others added 2 commits November 10, 2026 15:08
Backport of python/cpython@57937a8
(the work is counted with sys.settrace() since __getattribute__ has no
effect on the old-style classes of minidom)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants