CVE-2026-15310
zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
CVSS Score
0.0
EPSS Score
0.5%
EPSS Percentile
42th
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
| CWE | CWE-400 |
| Vendor | python software foundation |
| Product | cpython |
| Published | Aug 25, 2026 |
| Last Updated | Oct 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for python software foundation cpython
Be the first to know when new unknown vulnerabilities affecting python software foundation cpython are published โ delivered to Slack, Telegram or Discord.
Get Free Alerts โ
Free ยท No credit card ยท 60 sec setup
Affected Versions
Python Software Foundation / CPython
0 < 3.10.22 3.11.0 < 3.11.17 3.12.0 < 3.12.15 3.13.0 < 3.13.16 3.14.0 < 3.14.8 3.15.0a1 < 3.15.0rc2
References
github.com: https://github.com/python/cpython/pull/156003 github.com: https://github.com/python/cpython/issues/156002 mail.python.org: https://mail.python.org/archives/list/[email protected]/thread/YUHXURX2WZGKGNA4ANYBQS2VZRYQ5JNK/ github.com: https://github.com/python/cpython/commit/f897dbf2f36a5935700b7c2d94d4681d2136b7d4 github.com: https://github.com/python/cpython/commit/1b424c0178a01e155fd0267dc28a8fc1159b33a8 github.com: https://github.com/python/cpython/commit/31980e84b9a708424a0a1dfecde3fc991e313f89 github.com: https://github.com/python/cpython/commit/e2311cfb3dd518f008f312fe0631f4f7490d237a github.com: https://github.com/python/cpython/commit/f507e6946a3194e83e1d7b8ee6e14567175e46de github.com: https://github.com/python/cpython/commit/9d167992b59cf5e23c66b9ed742b13f5925f7d70 github.com: https://github.com/python/cpython/commit/dcdd406ddbfc4cb29b24c3df17cbabe21d316ce1 github.com: https://github.com/python/cpython/commit/09a2e7e6678b4f65449e7ad8f112c48f944591e2 github.com: https://github.com/python/cpython/commit/6257029de42ef89b67f3d20137de87d43e197530 github.com: https://github.com/python/cpython/commit/c2bfbcdd1a11690507a10bc0998f95b8dc6b6fac
Credits
๐ tonghuaroot (็ซฅ่ฏ) (https://github.com/tonghuaroot) Petr Viktorin (https://github.com/encukou) William Woodruff (https://github.com/woodruffw)