Skip to main content

CPython tarfile CVE-2026-11972

| EUVDEUVD-2026-38630 HIGH
Unchecked Return Value (CWE-252)
2026-06-23 PSF GHSA-wqxf-pjxh-hh4h
Denial Of Service Cpython Python Software Foundation
8.2
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify endpoint parsing tar streams
  2. Delivery
    Craft tar header with size 2^64
  3. Exploit
    Submit archive to streaming endpoint
  4. Install
    tarfile seek() loops on EOF reads
  5. C2
    CPU pinned, worker hangs
  6. Execute
    Repeat to exhaust workers
  7. Impact
    Service-wide denial of service

Vulnerability Assessment

Weakness
CWE
CWE-252
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Return value checking
Exploitation Conditions

Requires the target application to call tarfile.open() in streaming mode (mode='r|', including 'r|gz', 'r|bz2', 'r|xz') against attacker-controlled archive bytes, and to subsequently invoke an API that triggers seek() over member data (getmembers(), iteration, or extractall). Exploitation is limited to availability impact only - no code execution or data exposure - and is bounded by whatever CPU/time limits the host imposes on the Python worker; applications that use non-streaming mode 'r' on a real seekable file, or that never read tar data from untrusted sources, are not exposed.
Impact

CVSS 4.0 is 8.2 reflecting network attack vector, low complexity, no privileges or UI, with high availability impact and no confidentiality or integrity impact (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H). The AT:P (attack requirement: present) qualifier is meaningful - the victim service must accept and stream-parse an attacker-supplied tar archive, which is common in CI systems, package indexes, file-upload endpoints, and data-pipeline tooling but not universal. No EPSS, KEV, or SSVC data is provided; KEV is not listed and no public exploit was identified at time of analysis, so this is best treated as a high-impact DoS rather than an actively exploited threat. The PoC test in the patch is effectively a working trigger, so weaponization is trivial once the patch becomes public - defenders running tarfile streaming code on untrusted input should treat this as a near-term priority despite the absence of KEV/EPSS signals.
Exploit ScenarioDerived

An attacker uploads or serves a tiny tar archive containing a single header with TarInfo.size set to a huge value (e.g. 2^64) and no payload bytes; the victim service opens it with tarfile.open(fileobj=..., mode='r|') and calls getmembers() or iterates members, at which point _Stream.seek() loops forever reading empty bytes and pins a CPU core. Repeated submissions exhaust worker processes in package registries, CI runners, antivirus/unpackers, or web upload handlers, producing a low-bandwidth denial of service. The patch's test_getmembers_big_size testcase is a ready-made reproducer.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 23, 2026

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted tar archive opened in streaming mode (mode='r|'). The seek() routine fails to detect EOF and keeps requesting bufsize reads of empty data when a TarInfo header declares a size far larger than the actual stream, exhausting CPU on any Python service that parses untrusted tar streams. No public exploit identified at time of analysis, but the upstream fix and a reproducer test case are both published on GitHub.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/python/cpython/pull/151982, which adds a break when _Stream.seek() reads an empty buffer, and watch the PSF security-announce thread (https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/) for the tagged Python point releases that include it. Until a packaged release is available, compensating controls include refusing streaming mode for untrusted input (open archives in standard 'r' mode against a fully buffered file so seek() can rely on real positions), wrapping tarfile.open(..., mode='r|') calls with a CPU/wall-clock watchdog or signal.alarm to bound parse time, enforcing a maximum archive byte length at the network layer before handing data to tarfile, and rejecting members whose TarInfo.size exceeds a sane application limit. Trade-offs: forcing non-streaming mode requires buffering the entire archive in memory or on disk, and size caps may break legitimate large-archive workflows.

Affected VersionsENISA

CPython 0 <3.16.0

Affected Packages

euvd cpython fix: 3.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in Lib/tarfile.py within the _Stream.seek() helper, which iterates over self.read(self.bufsize) to advance past a member's data blocks. In streaming mode the underlying file object cannot be rewound, and when read() returns an empty bytes object at EOF the loop never decrements its counter nor breaks, so the loop continues for as many blocks as the (attacker-controlled) TarInfo.size declares - the PoC test sets size = 1 << 64. The CPE limits the affected product to python_software_foundation:cpython (all versions until the fix). CWE-252 (Unchecked Return Value) captures the root cause: the empty-bytes return from read() at EOF was ignored rather than treated as a terminating condition.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 7.5 HIGH

Network-reachable parsers accept attacker tar bytes with no auth or UI; only availability is affected via CPU exhaustion, hence C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 6.5 MEDIUM

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.

Executive ViewAI

Why It Matters

CPython's tarfile module (CVE-2026-11972) contains a denial-of-service vulnerability allowing attackers to exhaust CPU resources through specially crafted tar archives in streaming mode. Python services that parse untrusted tar streams-including backup systems, file compression tools, and package managers-face risk of service unavailability from resource exhaustion attacks. Immediate patch deployment is critical to maintain service continuity.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Prevalence
Ubiquitous
CPython standard library, shipped with virtually every Linux/macOS system and container
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-115557 CRITICAL
9.4 Oct 24

CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-114583 MEDIUM
6.9 Oct 22

CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archi
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

Same weakness CWE-252 – Unchecked Return Value

View all
CVE-2026-111497 CRITICAL POC
9.2
CVE-2021-26955 CRITICAL POC
9.8
CVE-2021-26958 HIGH POC
8.8
CVE-2019-15942 HIGH POC
8.8
CVE-2020-6078 HIGH POC
7.5
CVE-2026-85649 HIGH POC
7.9
CVE-2023-40303 HIGH POC
7.8
CVE-2020-6152 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/151982 ADVISORY https://access.redhat.com/errata/RHSA-2026:35806 ADVISORY https://access.redhat.com/errata/RHSA-2026:35807 ADVISORY https://access.redhat.com/errata/RHSA-2026:35812 ADVISORY https://access.redhat.com/errata/RHSA-2026:35813 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-11972 ADVISORY https://vuldb.com/vuln/373111 REF https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9 REF https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365 REF https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21 REF https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec REF https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192 REF https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896 REF https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438 REF https://github.com/python/cpython/issues/151981

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy