CVE-2025-12781
BaseFortify
Publication date: 2026-01-21
Last updated on: 2026-02-02
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| python | python | to 3.13.10 (exc) |
| python | python | From 3.14.0 (inc) to 3.14.1 (exc) |
| python | python | 3.15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-704 | The product does not correctly convert an object, resource, or structure from one type to a different type. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Python's base64 decoding functions (b64decode(), standard_b64decode(), and urlsafe_b64decode()) where the characters '+' and '/' are always accepted during decoding, regardless of the 'altchars' parameter that is supposed to specify an alternative base64 alphabet. This means that even if an application expects a different base64 alphabet (such as a URL-safe one without '+' and '/'), these characters are still accepted, which can cause data integrity issues. The behavior matches older base64 RFCs but conflicts with newer RFCs that recommend rejecting or raising errors for characters outside the specified alphabet. The vulnerability mainly affects applications using the 'altchars' parameter or urlsafe_b64decode(). The fix involves stricter validation and warnings but does not yet raise errors to maintain backward compatibility. [1, 2, 3]
How can this vulnerability impact me? :
If your application uses an alternative base64 alphabet via the 'altchars' parameter or the urlsafe_b64decode() function, this vulnerability can cause data integrity issues because '+' and '/' characters are accepted even when they should not be. This can lead to subtle bugs or security concerns where invalid or unexpected characters are silently accepted during decoding, potentially undermining the correctness and security of your data processing. If your application does not use alternative alphabets, it is not affected. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying if your application uses the base64 decoding functions with the altchars parameter or urlsafe_b64decode(), and then checking if inputs containing '+' or '/' characters are accepted when they should not be. You can test this by attempting to decode base64 strings with non-standard alphabets and observing if '+' or '/' characters are improperly accepted. For example, in Python, you can run commands like: ```python import base64 # Test decoding with altchars set to URL-safe alphabet try: decoded = base64.b64decode('/+/', altchars=b'-_') print('Decoded output:', decoded) except Exception as e: print('Error:', e) ``` If the decoding succeeds without error and accepts '+' or '/' characters despite altchars specifying an alternative alphabet, the vulnerability is present. Monitoring warnings emitted by the patched Python versions when invalid characters are encountered can also help detect the issue. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include validating that all user-controlled inputs strictly conform to the expected base64 alphabet before decoding, ensuring that inputs do not contain '+' or '/' characters if your application uses an alternative base64 alphabet via the altchars parameter or urlsafe_b64decode(). Additionally, review your application to confirm whether it uses the altchars parameter or urlsafe_b64decode(); if not, your application is not affected. Applying patches or upgrading to the Python version where this issue is addressed (Python 3.15 or later) is recommended once available. Until then, implement input validation to prevent data integrity issues caused by acceptance of invalid characters. [1, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability can lead to data integrity issues when applications use alternative base64 alphabets, as invalid characters '+' and '/' are accepted regardless of the specified alphabet. This may undermine strict data validation requirements that are often part of compliance with standards like GDPR or HIPAA, which mandate data integrity and proper handling of user inputs. However, the vulnerability only affects applications using the 'altchars' parameter or urlsafe_b64decode(), and mitigation involves validating inputs against the expected base64 alphabet. Therefore, failure to address this issue could potentially impact compliance by allowing corrupted or improperly validated data to be processed. [1, 3]