Skip to main content

CPython tarfile CVE-2026-11972

| EUVDEUVD-2026-38630 HIGH
Unchecked Return Value (CWE-252)
2026-06-23 PSF GHSA-wqxf-pjxh-hh4h
Denial Of Service Cpython Python Software Foundation
8.2
CVSS 4.0 · Vendor: PSF
Share

Severity by source

Vendor (PSF) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable parsers accept attacker tar bytes with no auth or UI; only availability is affected via CPU exhaustion, hence C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Jun 23, 2026 - 22:45 vuln.today
Analysis Generated
Jun 23, 2026 - 22:45 vuln.today

DescriptionCVE.org

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.

AnalysisAI

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted tar archive opened in streaming mode (mode='r|'). The seek() routine fails to detect EOF and keeps requesting bufsize reads of empty data when a TarInfo header declares a size far larger than the actual stream, exhausting CPU on any Python service that parses untrusted tar streams. No public exploit identified at time of analysis, but the upstream fix and a reproducer test case are both published on GitHub.

Technical ContextAI

The flaw lives in Lib/tarfile.py within the _Stream.seek() helper, which iterates over self.read(self.bufsize) to advance past a member's data blocks. In streaming mode the underlying file object cannot be rewound, and when read() returns an empty bytes object at EOF the loop never decrements its counter nor breaks, so the loop continues for as many blocks as the (attacker-controlled) TarInfo.size declares - the PoC test sets size = 1 << 64. The CPE limits the affected product to python_software_foundation:cpython (all versions until the fix). CWE-252 (Unchecked Return Value) captures the root cause: the empty-bytes return from read() at EOF was ignored rather than treated as a terminating condition.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/python/cpython/pull/151982, which adds a break when _Stream.seek() reads an empty buffer, and watch the PSF security-announce thread (https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/) for the tagged Python point releases that include it. Until a packaged release is available, compensating controls include refusing streaming mode for untrusted input (open archives in standard 'r' mode against a fully buffered file so seek() can rely on real positions), wrapping tarfile.open(..., mode='r|') calls with a CPU/wall-clock watchdog or signal.alarm to bound parse time, enforcing a maximum archive byte length at the network layer before handing data to tarfile, and rejecting members whose TarInfo.size exceeds a sane application limit. Trade-offs: forcing non-streaming mode requires buffering the entire archive in memory or on disk, and size caps may break legitimate large-archive workflows.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

CVE-2026-19672 MEDIUM
6.3 Aug 19

CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
CVE-2026-7210 MEDIUM
6.3 May 11

XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo
CVE-2026-3276 MEDIUM
6.3 Jun 03

Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions
CVE-2026-15806 MEDIUM
6.0 Aug 18

Credential disclosure in Python's urllib.request HTTPPasswordMgr class family enables scheme-downgrade attacks that expo

Same weakness CWE-252 – Unchecked Return Value

View all
CVE-2021-26955 CRITICAL POC
9.8
CVE-2021-26958 HIGH POC
8.8
CVE-2019-15942 HIGH POC
8.8
CVE-2026-85649 HIGH POC
7.9
CVE-2023-40303 HIGH POC
7.8
CVE-2020-6152 HIGH POC
7.8
CVE-2022-40279 HIGH POC
7.5
CVE-2022-38936 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-11972 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy