CVE catalog

CVE-2025-22153

RestrictedPython vulnerabilities

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrestrictedpythonsid8.4-1fixed
Debianrestrictedpythonforky8.4-1fixed
Debianrestrictedpythontrixie8.0-1fixed
Debianrestrictedpythonbookworm4.0~b3-3not affected
Ubunturestrictedpythonnoble6.2-1ubuntu0.24.04.1~esm1fixed
Ubuntupython3-restrictedpythonnoble6.2-1ubuntu0.24.04.1~esm1fixed
Ubunturestrictedpythonpro4.0~b3-3vulnerable
Ubunturestrictedpythonpro6.2-1vulnerable
Ubunturestrictedpythonpro6.2-1ubuntu0.24.04.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrestrictedpythonsourcesid8.0-1not yet assignedNot reported[1094026]
Debianrestrictedpythonsourceforky8.0-1not yet assignedNot reported[1094026]
Debianrestrictedpythonsourcetrixie8.0-1not yet assignedNot reported[1094026]
DebianrestrictedpythonsourcebookwormNot affectedunimportantNot reported[1094026]
Ubunturestrictedpythondebnoble6.2-1ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubuntupython3-restrictedpythondebnoble6.2-1ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubunturestrictedpythondebpro6.2-1ubuntu0.24.04.1~esm1Not reportedUBUNTU-CVE-2025-22153Not reported

[Debian bug #1094026]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-restrictedpython]Not affected

    Source package: [restrictedpython]

    Details (2)

    • 4.0~b3-3 · all · bookworm

      Not affected

      usn · restrictedpython · debian · bookworm

    • 4.0~b3-3 · all · bookworm

      Not affected

      usn · restrictedpython · debian · bookworm

[Debian 13 (Trixie)]

  • [python3-restrictedpython]Fixed

    Source package: [restrictedpython]

    Details (2)

    • 8.0-1 · all · trixie

      Fixed · Fixed: 8.0-1

      usn · restrictedpython · debian · 13

    • 8.0-1 · all · trixie

      Fixed · Fixed: 8.0-1

      usn · restrictedpython · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]