CVE-2026-11972
tarfile opened in streaming mode mishandles EOF
CVSS Score
0.0
EPSS Score
0.3%
EPSS Percentile
24th
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
| CWE | CWE-252 CWE-606 CWE-770 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Jun 23, 2026 |
| Last Updated | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.15.0
References
github.com: https://github.com/python/cpython/issues/151981 github.com: https://github.com/python/cpython/pull/151982 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/ github.com: https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9 github.com: https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365 github.com: https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21 github.com: https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec github.com: https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192 github.com: https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
Credits
🔍 Ryan Hileman (https://github.com/lunixbochs) Petr Viktorin (https://github.com/encukou) Stan Ulbrych (https://github.com/StanFromIreland)