CVE-2025-12781

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-rl9-python39</name>
	<range><lt>3.13.10</lt></range>
      </package>
      <package>
	<name>python27</name>
	<range><lt>3.13.10</lt></range>
      </package>
      <package>
	<name>python311</name>
	<range><lt>3.13.10</lt></range>
      </package>
      <package>
	<name>python312</name>
	<range><lt>3.13.10</lt></range>
      </package>
      <package>
	<name>python315</name>
	<range><lt>3.13.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>When passing data to the b64decode(), standard_b64decode(), and
	urlsafe_b64decode() functions in the "base64" module the characters
	"+/" will always be accepted, regardless of the value of "altchars"
	parameter, typically used to establish an "alternative base64
	alphabet" such as the URL safe alphabet. This behavior matches what is
	recommended in earlier base64 RFCs, but newer RFCs now recommend
	either dropping characters outside the specified base64 alphabet or
	raising an error. The old behavior has the possibility of causing data
	integrity issues.




This behavior can only be insecure if your
	application uses an alternate base64 alphabet (without "+/"). If your
	application does not use the "altchars" parameter or the
	urlsafe_b64decode() function, then your application does not use an
	alternative base64 alphabet.




The attached patches DOES NOT make
	the base64-decode behavior raise an error, as this would be a change
	in behavior and break existing programs. Instead, the patch deprecates
	the behavior which will be replaced with the newly recommended
	behavior in a future version of Python. Users are recommended to
	mitigate by verifying user-controlled inputs match the base64
	
alphabet they are expecting or verify that their application would
	not be 
affected if the b64decode() functions accepted "+" or "/"
	outside of altchars.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-12781</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-12781</url>
    </references>
    <dates>
      <discovery>2026-01-21</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>