CVE-2025-12781
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-21

Last updated on: 2026-02-02

Assigner: Python Software Foundation

Description
When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python.Β Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-21
Last Modified
2026-02-02
Generated
2026-05-07
AI Q&A
2026-01-21
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
python python to 3.13.10 (exc)
python python From 3.14.0 (inc) to 3.14.1 (exc)
python python 3.15.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-704 The product does not correctly convert an object, resource, or structure from one type to a different type.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability occurs in Python's base64 decoding functions (b64decode(), standard_b64decode(), and urlsafe_b64decode()) where the characters '+' and '/' are always accepted during decoding, regardless of the 'altchars' parameter that is supposed to specify an alternative base64 alphabet. This means that even if an application expects a different base64 alphabet (such as a URL-safe one without '+' and '/'), these characters are still accepted, which can cause data integrity issues. The behavior matches older base64 RFCs but conflicts with newer RFCs that recommend rejecting or raising errors for characters outside the specified alphabet. The vulnerability mainly affects applications using the 'altchars' parameter or urlsafe_b64decode(). The fix involves stricter validation and warnings but does not yet raise errors to maintain backward compatibility. [1, 2, 3]


How can this vulnerability impact me? :

If your application uses an alternative base64 alphabet via the 'altchars' parameter or the urlsafe_b64decode() function, this vulnerability can cause data integrity issues because '+' and '/' characters are accepted even when they should not be. This can lead to subtle bugs or security concerns where invalid or unexpected characters are silently accepted during decoding, potentially undermining the correctness and security of your data processing. If your application does not use alternative alphabets, it is not affected. [1, 2, 3]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by verifying if your application uses the base64 decoding functions with the altchars parameter or urlsafe_b64decode(), and then checking if inputs containing '+' or '/' characters are accepted when they should not be. You can test this by attempting to decode base64 strings with non-standard alphabets and observing if '+' or '/' characters are improperly accepted. For example, in Python, you can run commands like: ```python import base64 # Test decoding with altchars set to URL-safe alphabet try: decoded = base64.b64decode('/+/', altchars=b'-_') print('Decoded output:', decoded) except Exception as e: print('Error:', e) ``` If the decoding succeeds without error and accepts '+' or '/' characters despite altchars specifying an alternative alphabet, the vulnerability is present. Monitoring warnings emitted by the patched Python versions when invalid characters are encountered can also help detect the issue. [1, 2]


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include validating that all user-controlled inputs strictly conform to the expected base64 alphabet before decoding, ensuring that inputs do not contain '+' or '/' characters if your application uses an alternative base64 alphabet via the altchars parameter or urlsafe_b64decode(). Additionally, review your application to confirm whether it uses the altchars parameter or urlsafe_b64decode(); if not, your application is not affected. Applying patches or upgrading to the Python version where this issue is addressed (Python 3.15 or later) is recommended once available. Until then, implement input validation to prevent data integrity issues caused by acceptance of invalid characters. [1, 3]


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability can lead to data integrity issues when applications use alternative base64 alphabets, as invalid characters '+' and '/' are accepted regardless of the specified alphabet. This may undermine strict data validation requirements that are often part of compliance with standards like GDPR or HIPAA, which mandate data integrity and proper handling of user inputs. However, the vulnerability only affects applications using the 'altchars' parameter or urlsafe_b64decode(), and mitigation involves validating inputs against the expected base64 alphabet. Therefore, failure to address this issue could potentially impact compliance by allowing corrupted or improperly validated data to be processed. [1, 3]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart