Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-4516

Summary
Assigner-PSF
Assigner Org ID-28c92f92-d60d-412d-b760-e73465c3df22
Published At-15 May, 2025 | 13:29
Updated At-03 Jun, 2025 | 20:53
Rejected At-
Credits

Use-after-free in "unicode_escape" decoder with error handler

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:PSF
Assigner Org ID:28c92f92-d60d-412d-b760-e73465c3df22
Published At:15 May, 2025 | 13:29
Updated At:03 Jun, 2025 | 20:53
Rejected At:
▼CVE Numbering Authority (CNA)
Use-after-free in "unicode_escape" decoder with error handler

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Affected Products
Vendor
Python Software FoundationPython Software Foundation
Product
CPython
Repo
https://github.com/python/cpython
Default Status
unaffected
Versions
Affected
  • From 0 before 3.9.23 (python)
  • From 3.10.0 before 3.10.18 (python)
  • From 3.11.0 before 3.11.13 (python)
  • From 3.12.0 before 3.12.11 (python)
  • From 3.13.0 before 3.13.4 (python)
  • From 3.14.0a1 before 3.14.0b2 (python)
Problem Types
TypeCWE IDDescription
CWECWE-416CWE-416 Use After Free
Type: CWE
CWE ID: CWE-416
Description: CWE-416 Use After Free
Metrics
VersionBase scoreBase severityVector
4.05.9MEDIUM
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Version: 4.0
Base score: 5.9
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/python/cpython/issues/133767
issue-tracking
https://github.com/python/cpython/pull/129648
patch
https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/
vendor-advisory
https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142
patch
https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e
patch
https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292
patch
https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d
patch
https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f
patch
https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77
patch
https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b
patch
Hyperlink: https://github.com/python/cpython/issues/133767
Resource:
issue-tracking
Hyperlink: https://github.com/python/cpython/pull/129648
Resource:
patch
Hyperlink: https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/
Resource:
vendor-advisory
Hyperlink: https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142
Resource:
patch
Hyperlink: https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e
Resource:
patch
Hyperlink: https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292
Resource:
patch
Hyperlink: https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d
Resource:
patch
Hyperlink: https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f
Resource:
patch
Hyperlink: https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77
Resource:
patch
Hyperlink: https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b
Resource:
patch
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://www.openwall.com/lists/oss-security/2025/05/16/4
N/A
http://www.openwall.com/lists/oss-security/2025/05/19/1
N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/05/16/4
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/05/19/1
Resource: N/A
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cna@python.org
Published At:15 May, 2025 | 14:15
Updated At:03 Jun, 2025 | 14:15

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.05.9MEDIUM
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 4.0
Base score: 5.9
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-416Secondarycna@python.org
CWE ID: CWE-416
Type: Secondary
Source: cna@python.org
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292cna@python.org
N/A
https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429dcna@python.org
N/A
https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142cna@python.org
N/A
https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431fcna@python.org
N/A
https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77cna@python.org
N/A
https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8ecna@python.org
N/A
https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598bcna@python.org
N/A
https://github.com/python/cpython/issues/133767cna@python.org
N/A
https://github.com/python/cpython/pull/129648cna@python.org
N/A
https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/cna@python.org
N/A
http://www.openwall.com/lists/oss-security/2025/05/16/4af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2025/05/19/1af854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/issues/133767
Source: cna@python.org
Resource: N/A
Hyperlink: https://github.com/python/cpython/pull/129648
Source: cna@python.org
Resource: N/A
Hyperlink: https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/
Source: cna@python.org
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/05/16/4
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/05/19/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found