The vulnerability CVE-2025-12084 involves a quadratic algorithm in the _clear_id_cache function used by xml.dom.minidom methods such as appendChild() in Python. This inefficiency causes performance degradation and potential denial of service when constructing deeply nested XML documents. The issue has been identified and patched in various Python versions distributed by Red Hat. The Red Hat advisory RHSA-2026:1374 provides updates for affected Red Hat Enterprise Linux 8 variants and Python 3.11 packages. No CVSS score is provided, but the impact is rated moderate by Red Hat.

The vulnerability can cause denial of service by significantly degrading availability when processing XML documents with excessive nesting due to the quadratic time complexity of the node ID cache clearing algorithm. This may lead to resource exhaustion or application unresponsiveness in affected Python environments. There are no known exploits in the wild. The impact is rated medium/moderate severity by Red Hat.

A patch is available and should be applied to affected Python versions and Red Hat Enterprise Linux 8 distributions as described in Red Hat advisory RHSA-2026:1374. Users should update to the fixed Python packages (e.g., python3.11-3.11.13-4.el8_10 or later). Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigation is required beyond applying the official patch.