A Series of Simple DOS Vulnerabilities

@johnzhou721

Bug report

Update

Now, based on the specific location where the problem code appears, it has been re-split into five issues.

Bug description:

We have identified a series of simple quadratic complexity vulnerabilities. After confirmation by CPython's security team, since these DOS vulnerabilities pose a low threat and are relatively tedious to exploit, we can directly initiate requests in issues to seek assistance from the community for fixes.
Below are the specific locations of the different complexity issues we discovered.

1.

cpython/Lib/posixpath.py

Line 290 in f49a07b

def expandvars(path):

2.

cpython/Lib/email/message.py

Line 73 in 5ab66a8

def _parseparam(s):

3.

cpython/Lib/idlelib/editor.py

Line 1206 in 5ab66a8

while methodname[:1] == '<':

4.

cpython/Lib/email/_header_value_parser.py

Line 1424 in 5ab66a8

def get_phrase(value):

5.

cpython/Lib/email/_header_value_parser.py

Line 1506 in 5ab66a8

while value and (value[0]=='\\' or value[0] not in PHRASE_ENDS):

6.

cpython/Lib/email/_header_value_parser.py

Line 1688 in 5ab66a8

value = value[1:]

7.

cpython/Lib/email/_header_value_parser.py

Line 1697 in 5ab66a8

value = value[1:]

8.

cpython/Lib/email/_header_value_parser.py

Line 1847 in 5ab66a8

value = value[1:]

9.

cpython/Lib/email/_header_value_parser.py

Line 2200 in 5ab66a8

value = value[1:]

10.

cpython/Lib/email/_header_value_parser.py

Line 2231 in 5ab66a8

value = value[1:]

11.

cpython/Lib/email/_header_value_parser.py

Line 2260 in 5ab66a8

value = value[1:]

12.

cpython/Lib/email/_header_value_parser.py

Line 2411 in 5ab66a8

value = value[1:]

13.

cpython/Lib/email/_header_value_parser.py

Line 2570 in 5ab66a8

value = value[1:]

14.

cpython/Lib/email/_header_value_parser.py

Line 2642 in 5ab66a8

value = value[1:]

15.

cpython/Lib/email/_header_value_parser.py

Line 2762 in 5ab66a8

value = value[1:]

16.

cpython/Lib/email/_header_value_parser.py

Line 2965 in 5ab66a8

to_encode = to_encode[1:]

17.

cpython/Tools/freeze/checkextensions.py

Line 72 in e64395e

def expandvars(str, vars):

18.

cpython/Lib/ntpath.py

Line 403 in cb8a72b

def expandvars(path):

19.

cpython/Lib/idlelib/editor.py

Line 1373 in 5ab66a8

while True:

20.

cpython/Lib/idlelib/editor.py

Line 1454 in 98a5b83

while line and line[-1] in " \t":

21.

cpython/Lib/platform.py

Line 642 in 98a5b83

while platform and platform[-1] == '-':

Current repair status:

03/19 has been fixed. @johnzhou721
1 has been fixed. @Wulian233
2/4/5/6/7/8/9/10/11/12/13/14/15/16 has been fixed. @picnixz
1/18 has been fixed. @serhiy-storchaka

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Credits

Finder is kexinoh (Xiangfan Wu) from QI-ANXIN Technology Research Institute.

Linked PRs

@ZeroIntensity

@ZeroIntensity Indeed, some of these have been reported to PSRT and I recommended a public issue.

I fixed posixpath in #134927

I fixed posixpath in #134927

Among them, both 17 and 18 belong to path replacement issues. I think you can fix them together, which will accelerate the repair speed. It should be additionally noted that other problems such as the infinite loop vulnerability caused by 17 need to be handled.

As for expandvars(), there is a more efficient way. Also, I suspect there is other quadratic complexity vulnerability here. I am working on this.

As for , there is a more efficient way. Also, I suspect there is other quadratic complexity vulnerability here. I am working on this.expandvars()

Yes, there are still some vulnerabilities.
update: I have added two more.

pythongh-134873: Fix quadratic complexity in os.path.expandvars()

@barneygale

I may have found a new one:

cpython/Lib/pathlib/__init__.py

Line 144 in 5507eff

paths.extend(arg._raw_paths)

import pathlib
import time

def create_deep_path(n):
    p = pathlib.PurePath("a")
    for _ in range(n):
        p = pathlib.PurePath(p, p) # Each iteration doubles the number of path segments
    return p
start = time.time()
# 2^20 ≈ 1,000,000
deep_path = create_deep_path(20)
str(deep_path)  # Path resolution is triggered, which consumes a large amount of resources
end = time.time()
print(f"Time taken: {end - start:.2f} seconds")

Possible fix, replace with paths.append(str(arg))

Now: Time taken: 0.51 seconds
Fix: Time taken: 0.24 seconds

@barneygale Can you be confirm this?

Edit: 3.14 3.15 only #130748

_raw_paths contains unjoined parts, so we still them in full:

# The `_raw_paths` slot stores unjoined string paths. This is set in
# the `__init__()` method.
'_raw_paths',

Note that str(...) actually joins the string paths, so the behavior is not the same.

FYI: 19 is potentially non-exploitable if we can limit the maximum of indentwidth when loading the config (What's the difference between self.indentwidth and self.tabwidth in the editor anyways?)

Please open separate issue for each problem. os.path, IDLE, email -- they all are very different and need different solutions.

Ok, I'll do this.

…

---Original--- From: "Serhiy ***@***.***> Date: Sat, Jun 28, 2025 15:23 PM To: ***@***.***>; Cc: ***@***.******@***.***>; Subject: Re: [python/cpython] A Series of Simple DOS Vulnerabilities (Issue#134873) serhiy-storchaka left a comment (python/cpython#134873) Please open separate issue for each problem. os.path, IDLE, email -- they all are very different and need different solutions. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: ***@***.***>

I have added fout new issues.
#136061
#136063
#136065
#136066

Is there any left here or can this be closed now?

Actually no, please open issues for platform and tools (or maybe it's under the os.path issue) as well.

The platform issue is actually straightforward and I can take care of it now.

I updated it at the top of this issue to indicate that it has been split, which will help readers understand it quickly.

Ok. I put them in the PATH. Now it seems that it can be turned off.

No I meant, the platform one is separate from the path issues. But the checkextensions one is a path-one as it's expandvars-related

@picnixz

#136066 @picnixz

Thanks. We'll close this issue in particular and focus on the dedicated ones instead. Thanks for the report.

Navigation Menu

Repository navigation

A Series of Simple DOS Vulnerabilities #134873

Bug report

Update

Bug description:

Current repair status:

CPython versions tested on:

Operating systems tested on:

Credits

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

A Series of Simple DOS Vulnerabilities #134873

Description

Bug report

Update

Bug description:

Current repair status:

CPython versions tested on:

Operating systems tested on:

Credits

Linked PRs

Activity

sethmlarson commented on May 29, 2025

Wulian233 commented on May 30, 2025

kexinoh commented on May 30, 2025

johnzhou721 commented on May 30, 2025

picnixz commented on May 30, 2025

johnzhou721 commented on May 30, 2025

picnixz commented on May 30, 2025

serhiy-storchaka commented on May 30, 2025

kexinoh commented on May 30, 2025

Wulian233 commented on May 31, 2025

picnixz commented on May 31, 2025

johnzhou721 commented on Jun 22, 2025

serhiy-storchaka commented on Jun 28, 2025

kexinoh commented on Jun 28, 2025

kexinoh commented on Jun 28, 2025

StanFromIreland commented on Jun 28, 2025

picnixz commented on Jun 28, 2025

picnixz commented on Jun 28, 2025

picnixz commented on Jun 28, 2025

kexinoh commented on Jun 28, 2025

picnixz commented on Jun 28, 2025

kexinoh commented on Jun 28, 2025

picnixz commented on Jun 28, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions