CVE-2026-11972
published 2026-06-23CVE-2026-11972: When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take…
PriorityP343high8.2CVSS 4.0
AVNACLATPPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.71%
53.2th percentile
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| container-native-virtualization | ocp-virt-validation-checkup-rhel9 | — | — |
| debian | python3.11 | — | — |
| debian | python3.13 | — | — |
| debian | python3.14 | — | — |
| debian | python3.9 | — | — |
| devspaces | code-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| python | python | — | — |
| python36_3.6 | python36 | — | — |
| python_software_foundation | cpython | < 3.10.21 | 3.10.21 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.16 | 3.11.16 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.14 | 3.12.14 |
| python_software_foundation | cpython | >= 3.13.0 < 3.13.15 | 3.13.15 |
| python_software_foundation | cpython | >= 3.14.0 < 3.14.7 | 3.14.7 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0b4 | 3.15.0b4 |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
CVSS provenance
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Python CPython up to 3.15.x Tarfile return value (Issue 151981 / EUVD-2026-38630)
vuldb·2026-07-01·CVSS 8.2
CVE-2026-11972 [HIGH] Python CPython up to 3.15.x Tarfile return value (Issue 151981 / EUVD-2026-38630)
A vulnerability labeled as problematic has been found in Python CPython up to 3.15.x. Affected by this issue is some unknown functionality of the component Tarfile Module. The manipulation results in unchecked return value.
This vulnerability is known as CVE-2026-11972. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
GHSA
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.
ghsa_unreviewed·2026-06-24
CVE-2026-11972 [HIGH] CWE-252 When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.
Red Hat
python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode
vendor_redhat·2026-06-23·CVSS 8.2
CVE-2026-11972 [HIGH] CWE-835 python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode
python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
A flaw was found in the Python `tarfile` module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the `tarfile` module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives.
Statement: A flaw was found in the Python tarfile module. When processing a tar archive in streaming mode (mode='r|'), the _Stream.seek function does not properly check for e
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdechttps://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438https://github.com/python/cpython/issues/151981https://github.com/python/cpython/pull/151982https://mail.python.org/archives/list/[email protected]/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
2026-06-23
Published