CVE-2026-11972

tarfile opened in streaming mode mishandles EOF

State: Published
Severity: 8.2 High
Published: Jun 23, 2026
Updated: Aug 13, 2026
Reserved: Jun 11, 2026

Description

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	PSF

Weaknesses

CWE-252
CWE-606
CWE-770

Affected Products

Product	Versions
CPythonPython Software Foundation	before 3.10.21Affected 3.11.0 to before 3.11.16Affected 3.12.0 to before 3.12.14Affected 3.13.0 to before 3.13.15Affected 3.14.0 to before 3.14.7Affected 3.15.0a1 to before 3.15.0b4Affected

References

https://github.com/python/cpython/issues/151981issue-tracking
https://github.com/python/cpython/pull/151982patch
https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/vendor-advisory
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9patch
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365patch
https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21patch
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdecpatch
https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192patch
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896patch
https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.