CPython CVE-2025-8194

Upgrade to a CPython maintenance release that includes the fix from python/cpython PR 137027 (commit 57f5981d6260ed21266e0c26951b8564cc252bc2 and associated backports), which adds a negative-offset guard raising InvalidHeaderError; consult the python.org security-announce thread (https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/) for the exact patched version for your branch since the input does not name a specific release. Because patch refs point to commits and a PR rather than a single tagged release, treat the released patched version as not independently confirmed and verify it for your Python line. As an interim compensating control where upgrading is not immediately possible, apply the vendor-published monkeypatch that wraps the tarfile parser (https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1) after importing tarfile - note the trade-off that it modifies stdlib behavior at runtime and must be re-applied on every process start. Additionally, avoid parsing tar archives from untrusted sources, enforce timeouts / run extraction in a separate killable worker process or thread so a hang cannot deadlock the main service, and impose size limits before parsing.