CVE Feed

    Dashboard / CVE / CVE-2025-4516

    CVE-2025-4516

    There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

    Published:May 15, 2025
    Last Modified:Apr 22, 2026
    EPS:May 15, 2025
    EPSS Score:0.00209
    CVSS Score:5.1

    Affected Products

    Vendor
    Python
    Product
    Cpython

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-416 Use After Free

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-15310 (CVSS 2.1) — When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacke…
    CVE-2026-19672 (CVSS 6.3) — The tarfile module's tar and data extraction filters created directories outside the destination for members…
    CVE-2026-15806 (CVSS 6) — The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRe…
    CVE-2026-17084 (CVSS 6) — The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unico…
    CVE-2026-18503 (CVSS 2.4) — Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and …
    CVE-2026-6879 (CVSS 2) — `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath …
    CVE-2026-15308 (CVSS 8.7) — The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated untermi…
    CVE-2026-4360 (CVSS 2) — In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An a…
    CVE-2026-11972 (CVSS 8.2) — When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not …
    CVE-2026-0864 (CVSS 4.1) — When using the "configparser" module to write configuration files containing multi-line text values with carri…

    References

    https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292
    https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d
    https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142
    https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f
    https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77
    https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e
    https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b
    https://github.com/python/cpython/issues/133767
    https://github.com/python/cpython/pull/129648
    https://mail.python.org/archives/list/[email protected]/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/
    http://www.openwall.com/lists/oss-security/2025/05/16/4
    http://www.openwall.com/lists/oss-security/2025/05/19/1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High