CVE-2026-11972

Name
CVE-2026-11972
Description
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cna@python.org https://github.com/python/cpython/issues/151981
cna@python.org https://github.com/python/cpython/pull/151982
cna@python.org https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
cna@python.org https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
cna@python.org https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
cna@python.org https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
cna@python.org https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
cna@python.org https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
cna@python.org https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
cna@python.org https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
python3 edge-main 3.14.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.24-main 3.14.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.23-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.22-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
python3 3.21-main 3.12.14-r0 Natanael Copa <ncopa@alpinelinux.org> fixed