CVE-2026-6100
published 2026-04-13CVE-2026-6100: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a…
PriorityP347high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.58%
43.8th percentile
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| python_software_foundation | cpython | < 3.13.14 | 3.13.14 |
| python_software_foundation | cpython | >= 3.14.0a1 < 3.14.5rc1 | 3.14.5rc1 |
| python_software_foundation | cpython | >= 3.15.0a1 < 3.15.0b1 | 3.15.0b1 |
| ubuntu | python3.10 | — | — |
| ubuntu | python3.12 | — | — |
| ubuntu | python3.14 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.1CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.1CRITICAL
vendor_ubuntu3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pg25-7cx5-cvcm: Use-after-free (UAF) was possible in the `lzma
ghsa_unreviewed·2026-04-13
CVE-2026-6100 [CRITICAL] CWE-416 GHSA-pg25-7cx5-cvcm: Use-after-free (UAF) was possible in the `lzma
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error c
VulDB
Python CPython up to 3.14.x Decompression Call use after free (ID 148395)
vuldb·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] Python CPython up to 3.14.x Decompression Call use after free (ID 148395)
A vulnerability described as critical has been identified in Python CPython up to 3.14.x. Impacted is the function lzma.LZMADecompressor/bz2.BZ2Decompressor/gzip.GzipFile of the component Decompression Call Handler. Executing a manipulation can lead to use after free.
This vulnerability appears as CVE-2026-6100. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2026-07-06·CVSS 3.3
CVE-2026-9669 [LOW] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly normalized paths in the tarfile
module. An attacker could possibly use this issue to bypass path
restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2025-13462)
It was discovered that Python's HTMLParser incorrectly handled certain
malformed HTML input. An attacker could possibly use this issue to cause
Python to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)
It was discovered that Python's email module incorrectly quoted newlines
in headers. An attacker could possibly use this issue to inject arbitrary
email headers. This issue only affected Ubuntu 22.04 L
Red Hat
python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
vendor_redhat·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CWE-825 python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.d
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]
CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 mingw-python3: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 mingw-python3: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 mingw-python3: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python3.14: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.14: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.14: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 asahi-installer: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 asahi-installer: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]
CVE-2026-6100 asahi-installer: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python3.12: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.12: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.12: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python3.15: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.15: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.15: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
CVE-2026-6100 python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()`
Bugzilla
CVE-2026-6100 python3.10: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.10: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.10: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python3.6: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.6: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.6: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python3.11: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.11: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.11: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 python3.9: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 python3.9: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 python3.9: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-6100 asahi-installer: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
bugzilla·2026-04-13·CVSS 9.1
CVE-2026-6100 [CRITICAL] CVE-2026-6100 asahi-installer: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
CVE-2026-6100 asahi-installer: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Hackernews
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
blogs_hackernews·2026-05-04·CVSS 9.3
CVE-2026-41940 [CRITICAL] ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
This week, the shadows moved faster than the patches.
While most teams were still triaging last month’s alerts, attackers had already turned control panels into kill switches, kernels into open doors, and open-source pipelines into silent delivery systems.
The game has shifted from breach to occupation. They’re living inside SaaS sessions, pushing code with trusted commits, and scaling operations like legitimate businesses — except their product is chaos. And the underground is getting uncomfortably professional.
Here’s the full week
https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0ehttps://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437dhttps://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8bhttps://github.com/python/cpython/issues/148395https://github.com/python/cpython/pull/148396https://mail.python.org/archives/list/[email protected]/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/http://www.openwall.com/lists/oss-security/2026/04/13/10https://access.redhat.com/errata/RHSA-2026:10117https://access.redhat.com/errata/RHSA-2026:10140https://access.redhat.com/errata/RHSA-2026:10141https://access.redhat.com/errata/RHSA-2026:10711https://access.redhat.com/errata/RHSA-2026:10745https://access.redhat.com/errata/RHSA-2026:10774https://access.redhat.com/errata/RHSA-2026:10949https://access.redhat.com/errata/RHSA-2026:10950https://access.redhat.com/errata/RHSA-2026:11062https://access.redhat.com/errata/RHSA-2026:11077https://access.redhat.com/errata/RHSA-2026:11768https://access.redhat.com/errata/RHSA-2026:13692https://access.redhat.com/errata/RHSA-2026:13812https://access.redhat.com/errata/RHSA-2026:14652https://access.redhat.com/errata/RHSA-2026:14653https://access.redhat.com/errata/RHSA-2026:14656https://access.redhat.com/errata/RHSA-2026:16699https://access.redhat.com/errata/RHSA-2026:17525https://access.redhat.com/errata/RHSA-2026:17619https://access.redhat.com/errata/RHSA-2026:19019https://access.redhat.com/errata/RHSA-2026:19064https://access.redhat.com/errata/RHSA-2026:19175https://access.redhat.com/errata/RHSA-2026:19176https://access.redhat.com/errata/RHSA-2026:19177https://access.redhat.com/errata/RHSA-2026:19216https://access.redhat.com/errata/RHSA-2026:19549https://access.redhat.com/errata/RHSA-2026:19570https://access.redhat.com/errata/RHSA-2026:19571https://access.redhat.com/errata/RHSA-2026:19576https://access.redhat.com/errata/RHSA-2026:19590https://access.redhat.com/errata/RHSA-2026:21275https://access.redhat.com/errata/RHSA-2026:21682https://access.redhat.com/errata/RHSA-2026:25096https://access.redhat.com/errata/RHSA-2026:26187https://access.redhat.com/errata/RHSA-2026:30078https://access.redhat.com/errata/RHSA-2026:30087https://access.redhat.com/errata/RHSA-2026:30088https://access.redhat.com/errata/RHSA-2026:30089https://access.redhat.com/errata/RHSA-2026:8822https://access.redhat.com/errata/RHSA-2026:8824https://access.redhat.com/errata/RHSA-2026:9228https://access.redhat.com/security/cve/CVE-2026-6100https://bugzilla.redhat.com/show_bug.cgi?id=2457932https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json
2026-04-13
Published