EUVD-2026-65519
GHSA-xj79-6hh5-9w6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft zip with oversized declared member (bzip2/LZMA/Zstd)
-
DeliveryDeliver archive to target Python application
-
ExploitApplication opens archive via zipfile module
-
Execution_read1() decompresses without max_length bound
-
PersistProcess memory exhausted
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target opens a crafted zip archive using Python's zipfile module, and that the archive contains at least one member compressed with bzip2 (ZIP_BZIP2), LZMA (ZIP_LZMA), or Zstandard (ZIP_ZSTANDARD) - the DEFLATE (ZIP_DEFLATED) and stored (ZIP_STORED) formats are NOT vulnerable, as they already enforced output bounds. User interaction is required per CVSS UI:A: a human or automated process must explicitly open and read from the archive. Applications that automatically ingest user-supplied or externally-sourced zip files satisfy this condition without direct human involvement. Exploitation is limited to memory exhaustion of the Python process - it does not enable code execution, privilege escalation, or data access. The severity is further constrained by system memory limits and any process-level resource caps in place. |
| Impact | The CVSS 4.0 score of 2.1 accurately reflects the constrained real-world impact: VA:L indicates only low availability loss, UI:A requires that someone or something opens the crafted archive, and AT:P signals a specific attack requirement is present. There is no confidentiality or integrity impact (VC:N/VI:N). The vulnerability is not listed in CISA KEV and no public exploit code exists, consistent with the low CVSS score. The practical exposure is highest in server-side applications that automatically extract untrusted zip uploads - upload handlers, CI artifact processors, or document pipelines - where the UI:A condition is satisfied programmatically rather than by a human. For interactive desktop use, social engineering is required. Overall this is a low-priority finding for most organizations: impact is bounded by available process memory and does not enable code execution or data exfiltration. EPSS data was not provided in the input and cannot be assessed. |
| Exploit ScenarioDerived | An attacker crafts a zip archive containing a tiny bzip2, LZMA, or Zstandard compressed member that declares an extremely large uncompressed size in its local file header. When a server-side application (such as a file upload processor) opens the archive with Python's zipfile module and reads the member, _read1() decompresses without an output bound, causing the interpreter to allocate memory proportional to the declared size until the process is killed by the OS OOM killer or crashes. No public exploit code exists at time of analysis, but the technique is a standard zip-bomb variant trivially constructable with available archive tools. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Unbounded memory allocation in CPython's zipfile module allows a crafted archive to exhaust process memory during decompression of bzip2, LZMA, or Zstandard members. The ZipExtFile._read1() method lacked the max_length output bound that the DEFLATE code path already enforced, permitting a small compressed member with an attacker-controlled declared size to expand into unlimited memory per read call. No public exploit is identified at time of analysis; exploitation requires user interaction (opening the archive), and the CVSS 4.0 base score of 2.1 reflects the low, availability-only impact.
RemediationAI
The upstream fix is available as merged GitHub pull request https://github.com/python/cpython/pull/156003, which adds bounded decompress() calls for bzip2, LZMA, and Zstandard paths in zipfile. No officially tagged patched release version is confirmed from the available data - the fix exists as a merged PR commit but the PSF advisory at https://mail.python.org/archives/list/security-announce@python.org/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/ should be monitored for the official release version. As a compensating control prior to patching, applications processing untrusted archives should enforce a maximum archive and member size limit before passing data to zipfile (e.g., check ZipInfo.compress_size and ZipInfo.file_size), and should run extraction in a subprocess or container with an enforced memory limit (ulimit -v or cgroup memory.max) to bound the blast radius - note that the subprocess approach adds latency and IPC complexity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is ZipExtFile._read1() in CPython's Lib/zipfile/__init__.py, identified by CPE cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*. The root cause class is CWE-400 (Uncontrolled Resource Consumption): when decompressing bzip2 (ZIP_BZIP2), LZMA (ZIP_LZMA), or Zstandard (ZIP_ZSTANDARD) members, the code called decompress(data) without a max_length argument, allowing the underlying decompressor to return arbitrarily large output in a single call bounded only by the attacker-declared uncompressed size stored in the archive header. The DEFLATE path already passed max_length to its decompressor. The fix (PR #156003) adds max_length=max(n, MIN_READ_SIZE) to those three decompressor calls, and introduces a _decompressor_needs_input() helper plus a _needs_input property on the LZMA wrapper to correctly detect when buffered internal state can be drained without reading new compressed input - a prerequisite for bounded incremental reads across all four codecs.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-delivered archive requires victim to open it (UI:R); impact is limited to partial memory exhaustion with no confidentiality or integrity exposure.
Primary rating from Vendor (PSF).
CVSS VectorVendor: PSF
DescriptionCVE.org
When decompressing crafted zip files using the bzip/LZMA/Zstandard
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB