CVE-2025-4516

Description

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

How to fix CVE-2025-4516

To remediate CVE-2025-4516, upgrade the affected package to a fixed version below.

• Alpine/python3—upgrade to 3.11.12-r1 or later
• —upgrade to 3.9.23 or later
• —upgrade to 3.9.23 or later
• —upgrade to 3.9.23 or later
• —upgrade to 3.11.2-6+deb12u7 or later
• —upgrade to 3.13.3-4 or later
• —upgrade to 3.9.2-1+deb11u4 or later

Is CVE-2025-4516 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 3.11.12-r1
• from 0, < 3.9.23, >= 3.10.0, < 3.10.18, >= 3.11.0, < 3.11.13, >= 3.12.0, < 3.12.11, >= 3.13.0, < 3.13.4
• from 0, < 3.9.23, >= 3.10.0, < 3.10.18, >= 3.11.0, < 3.11.13, >= 3.12.0, < 3.12.11, >= 3.13.0, < 3.13.4
• from 0, < 3.9.23, >= 3.10.0, < 3.10.18, >= 3.11.0, < 3.11.13, >= 3.12.0, < 3.12.11, >= 3.13.0, < 3.13.4
• from 0, < 3.11.2-6+deb12u7
• from 0, < 3.13.3-4
• from 0, < 3.9.2-1+deb11u4

CVSS scores

References (15)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2025-4516
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-4516
• WEBgithub.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292
• WEBgithub.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d