Log in Start free

Vulnerability · Published Aug 25, 2026 · Assigned by PSF

CVE-2026-15310zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

Low 2.1

In plain English

A low-severity uncontrolled resource consumption in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.5%top 55.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21python33.12.15-r0ALPINE-CVE-2026-15310
Alpine:v3.22python33.12.15-r0ALPINE-CVE-2026-15310
Alpine:v3.23python33.12.15-r0ALPINE-CVE-2026-15310
Alpine:v3.24python33.14.8-r0ALPINE-CVE-2026-15310
Debian:12python3.113.11.2-6+deb12u9DEBIAN-CVE-2026-15310
Debian:13python3.13no fix listedDEBIAN-CVE-2026-15310
Debian:14python3.143.14.7-3DEBIAN-CVE-2026-15310
Debian:14python3.153.15.0~rc2-1DEBIAN-CVE-2026-15310
Ubuntu:22.04:LTSpython3.10no fix listedUBUNTU-CVE-2026-15310
Ubuntu:24.04:LTSpython3.12no fix listedUBUNTU-CVE-2026-15310
Ubuntu:26.04:LTSpython3.14no fix listedUBUNTU-CVE-2026-15310
Ubuntu:26.10python3.14no fix listedUBUNTU-CVE-2026-15310

Affected products (as reported)

VendorProductVersions
Python Software Foundation CPython 0 – before 3.10.223.11.0 – before 3.11.173.12.0 – before 3.12.153.13.0 – before 3.13.163.14.0 – before 3.14.83.15.0a1 – before 3.15.0rc2

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References