USN-8614-1: Python vulnerabilities
Publication date
27 July 2026
Overview
Several security issues were fixed in Python.
Releases
Packages
Details
It was discovered that Python incorrectly handled expanding environment
variables in os.path.expandvars() when the input was user-controlled. An
attacker could possibly use this issue to cause Python to consume
resources, leading to a denial of service. (CVE-2025-6075)
It was discovered that Python incorrectly handled certain malformed
HTML-like markup in the HTMLParser module, raising an uncaught exception.
A remote attacker could possibly use this issue to cause applications that
parse untrusted input to crash, resulting in a denial of service.
(CVE-2025-69534)
It was discovered that Python incorrectly handled expanding environment
variables in os.path.expandvars() when the input was user-controlled. An
attacker could possibly use this issue to cause Python to consume
resources, leading to a denial of service. (CVE-2025-6075)
It was discovered that Python incorrectly handled certain malformed
HTML-like markup in the HTMLParser module, raising an uncaught exception.
A remote attacker could possibly use this issue to cause applications that
parse untrusted input to crash, resulting in a denial of service.
(CVE-2025-69534)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 16.04 LTS xenial | libpython2.7-minimal – 2.7.12-1ubuntu0~16.04.18+esm21 | ||
| libpython2.7-stdlib – 2.7.12-1ubuntu0~16.04.18+esm21 | |||
| libpython3.5-stdlib – 3.5.2-2ubuntu0~16.04.13+esm24 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.