Vulnerability · Published Jun 23, 2026 · Assigned by PSF
CVE-2026-11972tarfile opened in streaming mode mishandles EOF
High 8.2
In plain English
A high-severity resource allocation without limits in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.7%top 46.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-11972 |
| Alpine:v3.22 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-11972 |
| Alpine:v3.23 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-11972 |
| Alpine:v3.24 | python3 | 3.14.7-r0 | ALPINE-CVE-2026-11972 |
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-11972 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-11972 |
| Debian:14 | pypy3 | 8.0.0+dfsg-1 | DEBIAN-CVE-2026-11972 |
| Debian:12 | python3.11 | no fix listed | DEBIAN-CVE-2026-11972 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u5 | DEBIAN-CVE-2026-11972 |
| Debian:14 | python3.14 | 3.14.7-1 | DEBIAN-CVE-2026-11972 |
| Ubuntu:22.04:LTS | python3.10 | no fix listed | UBUNTU-CVE-2026-11972 |
| Ubuntu:24.04:LTS | python3.12 | no fix listed | UBUNTU-CVE-2026-11972 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-11972 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-11972 |
| Ubuntu:26.04:LTS | python3.14 | no fix listed | UBUNTU-CVE-2026-11972 |
| Ubuntu:26.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-11972 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.153.14.0 – before 3.14.73.15.0a1 – before 3.15.0b4 |
Weakness: CWE-252, CWE-606, CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/python/cpython/issues/151981 issue-tracking
- https://github.com/python/cpython/pull/151982 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/ vendor-advisory
- https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9 patch
- https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365 patch
- https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21 patch
- https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec patch
- https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192 patch
- https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896 patch
- https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438 patch