Skip to main content

CPython bz2 module EUVDEUVD-2026-35202

| CVE-2026-9669 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-06-08 PSF GHSA-8jvr-397x-xqh9
Buffer Overflow Stack Overflow Cpython Python Software Foundation
8.2
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Python service decompressing user bzip2
  2. Delivery
    Submit crafted bzip2 stream via upload/API
  3. Exploit
    First decompress() raises OSError
  4. Execution
    Application's retry handler reuses BZ2Decompressor
  5. Persist
    Second decompress() triggers stack OOB write
  6. Impact
    Worker process crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-121
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target application must (1) accept bzip2-formatted input from an untrusted source, (2) decompress it using bz2.BZ2Decompressor (not the one-shot bz2.decompress() helper, which constructs a fresh decompressor per call), (3) catch the OSError raised on malformed input rather than letting it propagate, and (4) call decompress() a second time on the same BZ2Decompressor instance. Exploitation is limited by this required application coding pattern (reflected in CVSS AT:P and AC:H) - Python services that simply propagate the OSError, or that allocate a new decompressor per stream, are not vulnerable regardless of CPython version. No authentication is required at the CPython layer (PR:N) and no user interaction is needed, but exploitability is entirely gated by the calling application's retry logic.
Impact

Signals are consistent and point to a moderate, not critical, priority. CVSS 4.0 vector AV:N/AC:H/AT:P/PR:N/UI:N with only VA:H (availability) and zero confidentiality/integrity impact correctly characterizes this as a network-reachable but high-complexity DoS - AT:P (attack requirements present) reflects that the victim application must specifically catch OSError and retry decompression with the same object, which is an uncommon coding pattern. There is no EPSS score, no KEV listing, and no public exploit identified at time of analysis, so this is not a drop-everything patch. The 8.2 base score is driven by the network reach plus stack-buffer-overflow CWE classification, but the description and patch commentary frame the realistic impact as a process crash rather than confirmed code execution; whether the OOB write is exploitable for RCE on hardened modern stacks (canaries, ASLR, NX) is not asserted by upstream and should be treated as unknown rather than assumed.
Exploit ScenarioDerived

An attacker uploads a small crafted bzip2 blob (the patch test vector is ~92 bytes) to a Python web service that decompresses user-supplied archives - for example a file-upload endpoint, mail gateway, or log ingester. The first decompress() call raises OSError 'Invalid data stream'; if the service's error handler logs the failure and retries on the same BZ2Decompressor object (a not-uncommon resilience pattern), the second call performs out-of-bounds stack writes and crashes the worker process, producing repeatable denial of service.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 09, 2026

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sending crafted bzip2 data when the application reuses the decompressor object after catching a prior OSError. The flaw stems from libbz2's internal state being left inconsistent after a decompression error, and reuse causes out-of-bounds writes to a stack buffer. No public exploit identified at time of analysis and the issue is not in CISA KEV; the practical impact is denial of service against Python services that process untrusted bzip2 streams.

RemediationAI

Upgrade CPython to the patched release identified in the PSF security-announce advisory at https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/, which incorporates PR https://github.com/python/cpython/pull/150600; the upstream fix is confirmed in the cpython repository but exact tagged release versions should be taken from that advisory rather than inferred. As a code-level workaround if interpreter upgrade is blocked, modify application code so that BZ2Decompressor instances are discarded and re-instantiated after any OSError from decompress() rather than retried, which fully eliminates the unsafe reuse path at the cost of forcing callers to restart any in-progress stream. As a deployment compensating control, reject or quarantine untrusted bzip2 input at the boundary (size and source filtering on uploads, archives, and HTTP bodies) until the runtime is patched; the trade-off is reduced functionality for legitimate bzip2 uploads.

Affected VersionsENISA

CPython 0 <3.16.0

Affected Packages

euvd cpython fix: 3.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in Modules/_bz2module.c in CPython's wrapper around libbz2. When BZ2_bzDecompress() returns an error code, the wrapper previously raised OSError but left the underlying bz_stream in a state that libbz2 considers invalid for further calls. If a Python caller then invokes decompress() again on the same BZ2Decompressor instance, libbz2 re-enters its decompression state machine from a corrupted offset, producing out-of-bounds writes into a stack-allocated buffer used by the C extension - the textbook CWE-121 stack-based buffer overflow pattern. The fix (PR #150600) records the bzerror code on the decompressor and raises ValueError 'Decompressor is unusable after a previous error' on any subsequent call, preventing the second entry into BZ2_bzDecompress(). Affected CPE is cpe:2.3:a:python_software_foundation:cpython covering all versions prior to the patched releases.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 8.2 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.9 MEDIUM

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
CVSS changed
Jun 08, 2026 - 23:22 NVD
8.2 (HIGH)
CVE Published
Jun 08, 2026 - 22:01 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

Executive ViewAI

Why It Matters

CPython deployments processing untrusted bzip2-compressed data are vulnerable to remote denial of service attacks (CVSS 8.2), with no reported active exploitation at this time. Organizations relying on Python-based data pipelines, content processing systems, and compression-heavy workloads face potential service availability risks and operational disruption. Immediate inventory and patching of affected Python environments is required to prevent service outages.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-115557 CRITICAL
9.4 Oct 24

CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyon
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-114583 MEDIUM
6.9 Oct 22

CPython's tarfile.tar_filter extraction filter can be bypassed with crafted link members, allowing a malicious tar archi
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/150600 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9669 ADVISORY https://seclists.org/oss-sec/2026/q2/846 ADVISORY https://ubuntu.com/security/notices/USN-8509-1 ADVISORY https://vuldb.com/vuln/369305 REF http://www.openwall.com/lists/oss-security/2026/06/08/17 REF https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6 REF https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636 REF https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e REF https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f REF https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79 REF https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2 REF https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d REF https://github.com/python/cpython/issues/150599

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy