Skip to content
OpenAdvisories

Description

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Affected products

VendorProductAffectedFixed
Python Software Foundation CPython < 3.10.20, 3.11.0 – < 3.11.15, 3.12.0 – < 3.12.13, 3.13.0 – < 3.13.11, 3.14.0 – < 3.14.2, 3.15.0a1 – < 3.15.0a3 3.10.20

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jython No fix yet —
Debian 14 pypy3 7.3.21+dfsg-1 —
Debian 14 python3.14 3.14.2-1 —
Debian 13 pypy3 +1 No fix yet —
Debian 13 python3.13 3.13.5-2+deb13u1 —
Debian 12 pypy3 +1 No fix yet —
Debian 12 python3.11 3.11.2-6+deb12u7 —
Debian 11 python3.9 3.9.2-1+deb11u4 DLA-4455-1, DLA-4445-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pypy3 +1 No fix yet —
Ubuntu 26.04 LTS pypy3 +1 No fix yet —
Ubuntu 25.10 pypy3 +1 No fix yet —
Ubuntu 25.10 python3.13 3.13.7-1ubuntu0.3 —
Ubuntu 25.10 python3.14 3.14.0-1ubuntu0.2 —
Ubuntu 24.04 LTS pypy3 +1 No fix yet —
Ubuntu 24.04 LTS python3.12 3.12.3-1ubuntu0.11 —
Ubuntu 22.04 LTS pypy3 +1 No fix yet —
Ubuntu 22.04 LTS python3.10 3.10.12-1~22.04.14 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS pypy3 +1 No fix yet —
Ubuntu 18.04 LTS jython No fix yet —
Ubuntu 16.04 LTS jython No fix yet —
Ubuntu Pro 22.04 LTS python2.7 2.7.18-13ubuntu1.5+esm8 —
Ubuntu Pro 22.04 LTS python3.11 3.11.0~rc1-1~22.04.1~esm8 —
Ubuntu Pro 20.04 LTS python3.8 3.8.10-0ubuntu1~20.04.18+esm5 —
Ubuntu Pro 20.04 LTS python3.9 3.9.5-3ubuntu0~20.04.1+esm9 —
Ubuntu Pro 18.04 LTS python2.7 2.7.17-1~18.04ubuntu1.13+esm14 —
Ubuntu Pro 18.04 LTS python3.6 3.6.9-1~18.04ubuntu1.13+esm8 —
Ubuntu Pro 18.04 LTS python3.7 3.7.5-2ubuntu1~18.04.2+esm9 —
Ubuntu Pro 18.04 LTS python3.8 3.8.0-3ubuntu1~18.04.2+esm9 —
Ubuntu Pro 16.04 LTS python2.7 2.7.12-1ubuntu0~16.04.18+esm19 —
Ubuntu Pro 16.04 LTS python3.5 3.5.2-2ubuntu0~16.04.13+esm21 —
Ubuntu Pro 14.04 LTS python2.7 2.7.6-8ubuntu0.6+esm29 —
Ubuntu Pro 14.04 LTS python3.4 3.4.3-1ubuntu1~14.04.7+esm19 —
Ubuntu Pro 14.04 LTS python3.5 3.5.2-2ubuntu0~16.04.4~14.04.1+esm9 —
ReleasePackageFixed inAdvisory
RHEL 10 python3 +8 3.12.12-3.el10_1 RHSA-2026:1828
RHEL 9 python3 +8 3.9.25-3.el9_7 RHSA-2026:1478
RHEL 9 python3.11 +6 3.11.13-5.el9_7 RHSA-2026:1410
RHEL 9 python3.12 +6 3.12.12-4.el9_7 RHSA-2026:1408
RHEL 8 python3 +7 3.6.8-72.el8_10 RHSA-2026:1631
RHEL 8 python3.11 +7 3.11.13-4.el8_10 RHSA-2026:1374
RHEL 8 python3.12 +7 3.12.12-1.el8_10 RHSA-2026:0123
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS python3 +8 3.12.9-2.el10_0.6 RHSA-2026:2233
RHEL 9.6 EUS python3 +8 3.9.21-2.el9_6.3 RHSA-2026:2275
RHEL 9.6 EUS python3.11 +6 3.11.11-2.el9_6.4 RHSA-2026:1892
RHEL 9.6 EUS python3.12 +6 3.12.9-1.el9_6.4 RHSA-2026:1583
RHEL 9.4 EUS python3 +8 3.9.18-3.el9_4.10 RHSA-2026:2276
RHEL 9.4 EUS python3.11 +6 3.11.7-1.el9_4.10 RHSA-2026:1893
RHEL 9.4 EUS python3.12 +6 3.12.1-4.el9_4.9 RHSA-2026:1582
RHEL 9.2 E4S python3 +5 3.9.16-1.el9_2.11 RHSA-2026:2392
RHEL 9.2 E4S python3.11 +3 3.11.2-2.el9_2.9 RHSA-2026:1922
RHEL 9.0 E4S python3 +5 3.9.10-4.el9_0.8 RHSA-2026:2393
RHEL 8.8 TUS python3 +7 3.6.8-51.el8_8.12 RHSA-2026:2330
RHEL 8.8 TUS python3.11 +4 3.11.2-2.el8_8.7 RHSA-2026:2084
RHEL 8.8 E4S python3 +7 3.6.8-51.el8_8.12 RHSA-2026:2330
RHEL 8.8 E4S python3.11 +4 3.11.2-2.el8_8.7 RHSA-2026:2084
RHEL 8.6 TUS python3 +7 3.6.8-47.el8_6.10 RHSA-2026:2391
RHEL 8.6 E4S python3 +7 3.6.8-47.el8_6.10 RHSA-2026:2391
RHEL 8.6 AUS python3 +7 3.6.8-47.el8_6.10 RHSA-2026:2391
RHEL 8.4 EUS Long Life python3 +7 3.6.8-39.el8_4.8 RHSA-2026:1558
RHEL 8.4 AUS python3 +7 3.6.8-39.el8_4.8 RHSA-2026:1558
RHEL 8.2 AUS python3 +7 3.6.8-24.el8_2.5 RHSA-2026:1620
RHEL 7 ELS python +6 2.7.5-94.el7_9.2 RHSA-2026:1537
RHEL 7 ELS python3 +6 3.6.8-21.el7_9.3 RHSA-2026:2713
Red Hat Hardened Images 1 python3 +15 3.14.4-1.hum1 RHSA-2026:7661
Red Hat Hardened Images 1 python3.11 +6 3.11.15-4.hum1 RHSA-2026:8822
Red Hat Hardened Images 1 python3.12 +6 3.12.13-3.hum1 RHSA-2026:8824
Red Hat Hardened Images 1 python3.13 +8 3.13.13-1.hum1 RHSA-2026:7443

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 python-unversioned-command 3.12.12-3.el10_1 ALSA-2026:1828
AlmaLinux 9 python3 +7 3.9.25-3.el9_7 ALSA-2026:1478
AlmaLinux 9 python3.11 +6 3.11.13-5.el9_7 ALSA-2026:1410
AlmaLinux 9 python3.12 +6 3.12.12-4.el9_7 ALSA-2026:1408
AlmaLinux 8 python3-idle +6 3.6.8-72.el8_10.alma.1 ALSA-2026:1631
AlmaLinux 8 python3.11 +7 3.11.13-4.el8_10 ALSA-2026:1374
AlmaLinux 8 python3.12 +7 3.12.12-1.el8_10 ALSA-2026:0123

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 python3.12 3.12.12-3.el10_1 RLSA-2026:1828
Rocky Linux 9 python3.11 3.11.13-5.el9_7 RLSA-2026:1410
Rocky Linux 9 python3.12 3.12.12-4.el9_7 RLSA-2026:1408
Rocky Linux 9 python3.9 3.9.25-3.el9_7 RLSA-2026:1478
Rocky Linux 8 python3 3.6.8-72.el8_10.rocky.0 RLSA-2026:1631
Rocky Linux 8 python3.11 3.11.13-4.el8_10 RLSA-2026:1374
Rocky Linux 8 python3.12 3.12.12-1.el8_10 RLSA-2026:0123
ReleasePackageFixed inAdvisory
SLES 15 SP7 python +1 2.7.18-150000.94.1 SUSE-SU-2026:0268-1
SLES 15 SP7 python3 +1 3.6.15-150300.10.103.1 SUSE-SU-2026:0027-1
SLES 15 SP7 python311-core 3.11.14-150600.3.41.2 SUSE-SU-2026:1349-1, SUSE-SU-2026:0314-1
SLES 15 SP6 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES 15 SP5 python311 +2 3.11.14-150400.9.72.1 SUSE-SU-2026:1117-1, SUSE-SU-2026:0299-1
SLES 15 SP4 python311 +2 3.11.14-150400.9.72.1 SUSE-SU-2026:1117-1, SUSE-SU-2026:0299-1
SLES 12 SP5 python +2 2.7.18-33.56.1 SUSE-SU-2026:0133-1
SLES 12 SP5 python3 +1 3.4.10-25.166.1 SUSE-SU-2025:4538-1
SLES 12 SP5 python36 +1 3.6.15-97.1 SUSE-SU-2025:4539-1
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 3 python311 +1 3.11.14-150600.3.41.2 SUSE-SU-2026:1349-1, SUSE-SU-2026:0314-1
SLES 3 python313 +1 3.13.11-150700.4.36.1 SUSE-SU-2026:0024-1
SLES for SAP 16.0 python313 +2 3.13.11-160000.1.1 SUSE-SU-2026:20125-1
SLES for SAP 15 SP6 python311 +1 3.11.15-150600.3.53.1 SUSE-SU-2026:1349-1
SLES for SAP 15 SP5 python311 +2 3.11.14-150400.9.72.1 SUSE-SU-2026:1117-1, SUSE-SU-2026:0299-1
SLES for SAP 15 SP4 python311 +2 3.11.14-150400.9.72.1 SUSE-SU-2026:1117-1, SUSE-SU-2026:0299-1
SLES 16.0 python313 +2 3.13.11-160000.1.1 SUSE-SU-2026:20125-1
SLE Micro 6.2 python313 +1 3.13.11-160000.1.1 SUSE-SU-2026:20154-1
SLE Micro 6.1 python311 +1 3.11.14-slfo.1.1_2.1 SUSE-SU-2026:20768-1, SUSE-SU-2026:20374-1
SLE Micro 6.0 python311 +1 3.11.14-2.1 SUSE-SU-2026:20796-1, SUSE-SU-2026:20047-1
SLE Micro 5.5 python3 +1 3.6.15-150300.10.103.1 SUSE-SU-2026:0027-1
SLE Micro 5.4 python3 +1 3.6.15-150300.10.103.1 SUSE-SU-2026:0027-1
SLE Micro 5.3 python3 +1 3.6.15-150300.10.103.1 SUSE-SU-2026:0027-1
SLE Micro 5.2 python3 +1 3.6.15-150300.10.103.1 SUSE-SU-2026:0027-1
SLE HPC 15 SP5 python311 +2 3.11.14-150400.9.72.1 SUSE-SU-2026:1117-1, SUSE-SU-2026:0299-1
SLE HPC 15 SP4 python311 +2 3.11.14-150400.9.72.1 SUSE-SU-2026:1117-1, SUSE-SU-2026:0299-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python310 3.10.19-3.1 openSUSE-SU-2025:15839-1
openSUSE Tumbleweed python311 3.11.14-3.1 openSUSE-SU-2025:15849-1
openSUSE Tumbleweed python312 3.12.12-4.1 openSUSE-SU-2025:15850-1
openSUSE Tumbleweed python313 3.13.11-1.1 openSUSE-SU-2025:15851-1
openSUSE Tumbleweed python314 3.14.2-1.1 openSUSE-SU-2026:10011-1
openSUSE Tumbleweed python315 3.15.0~a3-1.1 openSUSE-SU-2025:15840-1
openSUSE Tumbleweed python39 3.9.25-2.1 openSUSE-SU-2025:15846-1
openSUSE Leap 16.0 python313 +4 3.13.11-160000.1.1 openSUSE-SU-2026:20081-1
openSUSE Leap 15.6 python +2 2.7.18-150000.94.1 SUSE-SU-2026:0268-1
openSUSE Leap 15.6 python3 +2 3.6.15-150300.10.103.1 SUSE-SU-2026:0027-1
openSUSE Leap 15.6 python310 +2 3.10.19-150400.4.94.1 SUSE-SU-2026:0130-1
openSUSE Leap 15.6 python311 +1 3.11.14-150600.3.41.2 SUSE-SU-2026:1349-1, SUSE-SU-2026:0314-1
openSUSE Leap 15.6 python311-documentation 3.11.14-150600.3.41.1 SUSE-SU-2026:1349-1, SUSE-SU-2026:0314-1
openSUSE Leap 15.6 python312 +2 3.12.12-150600.3.40.1 SUSE-SU-2026:0025-1
openSUSE Leap 15.6 python39 +2 3.9.25-150300.4.90.1 SUSE-SU-2025:4522-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3 +7 3.9.25-1.amzn2023.0.2 ALAS2023-2025-1325
Amazon Linux 2023 python3.11 +6 3.11.14-1.amzn2023.0.3 ALAS2023-2025-1356
Amazon Linux 2023 python3.12 +6 3.12.12-2.amzn2023.0.3 ALAS2023-2025-1344
Amazon Linux 2023 python3.13 +8 3.13.11-1.amzn2023.0.1 ALAS2023-2025-1343
Amazon Linux 2 python +6 2.7.18-1.amzn2.0.15 ALAS2-2026-3128
Amazon Linux 2 python3 +6 3.7.16-1.amzn2.0.22 ALAS2-2025-3103

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-py No fix yet —
Azure Linux 3 python3 3.12.9-7 —
Azure Linux 2 (CBL-Mariner) python3 3.9.19-19 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 python3 +7 3.12.12-3.0.1.el10_1 ELSA-2026-1828
Oracle Linux 9 python3 +7 3.9.25-3.0.1.el9_7 ELSA-2026-1478
Oracle Linux 9 python3.11 +6 3.11.13-5.0.1.el9_7 ELSA-2026-1410
Oracle Linux 9 python3.12 +6 3.12.12-4.0.1.el9_7 ELSA-2026-1408
Oracle Linux 8 python3-idle +6 3.6.8-72.0.1.el8_10 ELSA-2026-1631
Oracle Linux 8 python3.11 +7 3.11.13-4.0.1.el8_10 ELSA-2026-1374
Oracle Linux 8 python3.12 +7 3.12.12-1.el8_10 ELSA-2026-0123
Oracle Linux 7 python +6 2.7.5-94.0.3.el7_9 ELSA-2026-1537
Oracle Linux 7 python3 +6 3.6.8-21.0.7.el7_9 ELSA-2026-2713

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling python-3.10 3.10.19-r4 —
Wolfi rolling python-3.11 3.11.15-r0 —
Wolfi rolling python-3.12 3.12.12-r4 —
Wolfi rolling python-3.13 3.13.11-r2 —
Wolfi rolling python-3.14 3.14.2-r1 —

Advisories 50

References