GeezerVison is showing github.com — [3.11] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) by hartwork · Pull Request #139529 · python/cpython
Conversation
hartwork
commented
Oct 2, 2025
•
edited by github-actions
Bot
Loading
Uh oh!
There was an error while loading. Please reload this page.
Expose the XML Expat 2.7.2 mitigation APIs to disallow use of disproportional amounts of dynamic memory from within an Expat parser (see CVE-2025-59375 for instance).
The exposed APIs are available on Expat parsers, that is, parsers created by xml.parsers.expat.ParserCreate(), as:
parser.SetAllocTrackerActivationThreshold(threshold), and
parser.SetAllocTrackerMaximumAmplification(max_factor).
(cherry picked from commit f04bea4)
CC @picnixz
📚 Documentation preview 📚: https://cpython-previews--139529.org.readthedocs.build/
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
…2025-59375) (python#139234)
Expose the XML Expat 2.7.2 mitigation APIs to disallow use of
disproportional amounts of dynamic memory from within an Expat
parser (see CVE-2025-59375 for instance).
The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:
- `parser.SetAllocTrackerActivationThreshold(threshold)`, and
- `parser.SetAllocTrackerMaximumAmplification(max_factor)`.
(cherry picked from commit f04bea4)
…on API (python#139366)
Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.
(cherry picked from commit 68a1778)
|
To have a good synchronization, we'll also delay 3.10 to 3.13 backports for their next release cycle (see #139359 (comment)).
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
I set DO-NOT-MERGE to avoid confusion. Unset that when you think we should be releasing this.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
|
Thanks a lot for the backport and thanks for the patience :)
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Reviewers
picnixz
picnixz approved these changes
Uh oh!
There was an error while loading. Please reload this page.
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|