Skip to content

Commit 253f5ee

Browse files
serhiy-storchakamcepl
serhiy-storchaka
authored and
mcepl
committed
[CVE-2025-6075] Fix quadratic complexity in os.path.expandvars()
Replaces the hand-rolled, character-by-character scanning loops in posixpath.expandvars() and ntpath.expandvars() with a single re.sub() pass over lazily compiled regular expressions (compiled once and cached in the module-level _varsub/_varsubb globals). Fixes: bsc#1252974 (CVE-2025-6075) Fixes: gh#python#136065 From-PR: gh#python/cpython!134952 Patch: CVE-2025-6075-expandvars-perf-degrad.patch
1 parent 7fc4072 commit 253f5ee

5 files changed

Lines changed: 767 additions & 577 deletions

File tree

0 commit comments

Comments
 (0)