USN-8614-1

It was discovered that Python incorrectly handled expanding environment variables in os.path.expandvars() when the input was user-controlled. An attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2025-6075)

It was discovered that Python incorrectly handled certain malformed HTML-like markup in the HTMLParser module, raising an uncaught exception. A remote attacker could possibly use this issue to cause applications that parse untrusted input to crash, resulting in a denial of service. (CVE-2025-69534)