Vulnerability · Published Apr 13, 2026 · Assigned by PSF
CVE-2026-6100Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
High 8.1
In plain English
A high-severity use-after-free in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 52.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | platform-python | 3.6.8-76.el8_10.alma.1 | ALSA-2026:11077 |
| AlmaLinux:8 | platform-python-debug | 3.6.8-76.el8_10.alma.1 | ALSA-2026:11077 |
| AlmaLinux:8 | platform-python-devel | 3.6.8-76.el8_10.alma.1 | ALSA-2026:11077 |
| AlmaLinux:10 | python-unversioned-command | 3.12.12-3.el10_1.3 | ALSA-2026:10711 |
| AlmaLinux:10 | python-unversioned-command | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:9 | python-unversioned-command | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:9 | python-unversioned-command | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3 | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:9 | python3 | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:9 | python3 | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-debug | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:9 | python3-debug | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:9 | python3-debug | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:10 | python3-devel | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:9 | python3-devel | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:9 | python3-devel | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-idle | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-idle | 3.6.8-76.el8_10.alma.1 | ALSA-2026:11077 |
| AlmaLinux:9 | python3-idle | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:9 | python3-idle | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-libs | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-libs | 3.6.8-76.el8_10.alma.1 | ALSA-2026:11077 |
| AlmaLinux:9 | python3-libs | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:9 | python3-libs | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-test | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-test | 3.6.8-76.el8_10.alma.1 | ALSA-2026:11077 |
| AlmaLinux:9 | python3-test | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:9 | python3-test | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:10 | python3-tkinter | 3.12.13-2.el10_2 | ALSA-2026:19064 |
| AlmaLinux:8 | python3-tkinter | 3.6.8-76.el8_10.alma.1 | ALSA-2026:11077 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-7.el9_8 | ALSA-2026:19216 |
| AlmaLinux:9 | python3-tkinter | 3.9.25-3.el9_7.3 | ALSA-2026:10949 |
| AlmaLinux:8 | python3.11 | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:9 | python3.11 | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:9 | python3.11 | 3.11.13-5.3.el9_7 | ALSA-2026:10774 |
| AlmaLinux:8 | python3.11-debug | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:9 | python3.11-debug | 3.11.13-5.3.el9_7 | ALSA-2026:10774 |
| AlmaLinux:9 | python3.11-debug | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-devel | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:9 | python3.11-devel | 3.11.13-5.3.el9_7 | ALSA-2026:10774 |
| AlmaLinux:9 | python3.11-devel | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-idle | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:9 | python3.11-idle | 3.11.13-5.3.el9_7 | ALSA-2026:10774 |
| AlmaLinux:9 | python3.11-idle | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-libs | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:9 | python3.11-libs | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:9 | python3.11-libs | 3.11.13-5.3.el9_7 | ALSA-2026:10774 |
| AlmaLinux:8 | python3.11-rpm-macros | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:8 | python3.11-test | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:9 | python3.11-test | 3.11.13-5.3.el9_7 | ALSA-2026:10774 |
| AlmaLinux:9 | python3.11-test | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.11-tkinter | 3.11.13-7.el8_10 | ALSA-2026:11062 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.13-5.3.el9_7 | ALSA-2026:10774 |
| AlmaLinux:9 | python3.11-tkinter | 3.11.13-9.el9_8 | ALSA-2026:19175 |
| AlmaLinux:8 | python3.12 | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12 | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:9 | python3.12 | 3.12.12-4.el9_7.3 | ALSA-2026:10745 |
| AlmaLinux:8 | python3.12-debug | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-debug | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:9 | python3.12-debug | 3.12.12-4.el9_7.3 | ALSA-2026:10745 |
| AlmaLinux:8 | python3.12-devel | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-devel | 3.12.12-4.el9_7.3 | ALSA-2026:10745 |
| AlmaLinux:9 | python3.12-devel | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-idle | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-idle | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:9 | python3.12-idle | 3.12.12-4.el9_7.3 | ALSA-2026:10745 |
| AlmaLinux:8 | python3.12-libs | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-libs | 3.12.12-4.el9_7.3 | ALSA-2026:10745 |
| AlmaLinux:9 | python3.12-libs | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:8 | python3.12-test | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-test | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:9 | python3.12-test | 3.12.12-4.el9_7.3 | ALSA-2026:10745 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.13-2.el8_10 | ALSA-2026:10950 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.12-4.el9_7.3 | ALSA-2026:10745 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.13-2.el9_8 | ALSA-2026:19177 |
| AlmaLinux:10 | python3.14 | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14 | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-debug | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-debug | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-devel | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-devel | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-debug | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-debug | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-devel | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-devel | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-idle | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-idle | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-libs | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-libs | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-test | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-test | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-freethreading-tkinter | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-freethreading-tkinter | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-idle | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-idle | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-libs | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-libs | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-test | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-test | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| AlmaLinux:10 | python3.14-tkinter | 3.14.4-2.el10_2 | ALSA-2026:19019 |
| AlmaLinux:9 | python3.14-tkinter | 3.14.4-2.el9_8 | ALSA-2026:19176 |
| Alpine:v3.21 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-6100 |
| Alpine:v3.22 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-6100 |
| Alpine:v3.23 | python3 | 3.12.14-r0 | ALPINE-CVE-2026-6100 |
| Debian:12 | python3.11 | 3.11.2-6+deb12u8 | DEBIAN-CVE-2026-6100 |
| Debian:13 | python3.13 | 3.13.5-2+deb13u2 | DEBIAN-CVE-2026-6100 |
| Debian:14 | python3.14 | 3.14.5~rc1-1 | DEBIAN-CVE-2026-6100 |
| Rocky Linux:8 | python3 | 0:3.6.8-76.el8_10.rocky.0 | RLSA-2026:11077 |
| Rocky Linux:8 | python3.11 | 0:3.11.13-7.el8_10 | RLSA-2026:11062 |
| Rocky Linux:9 | python3.11 | 0:3.11.13-5.3.el9_7 | RLSA-2026:10774 |
| Rocky Linux:9 | python3.11 | 0:3.11.13-9.el9_8 | RLSA-2026:19175 |
| Rocky Linux:10 | python3.12 | 0:3.12.13-2.el10_2 | RLSA-2026:19064 |
| Rocky Linux:8 | python3.12 | 0:3.12.13-2.el8_10 | RLSA-2026:10950 |
| Rocky Linux:9 | python3.12 | 0:3.12.13-2.el9_8 | RLSA-2026:19177 |
| Rocky Linux:9 | python3.12 | 0:3.12.12-4.el9_7.3 | RLSA-2026:10745 |
| Rocky Linux:10 | python3.14 | 0:3.14.4-2.el10_2 | RLSA-2026:19019 |
| Rocky Linux:9 | python3.14 | 0:3.14.4-2.el9_8 | RLSA-2026:19176 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-7.el9_8 | RLSA-2026:19216 |
| Rocky Linux:9 | python3.9 | 0:3.9.25-3.el9_7.3 | RLSA-2026:10949 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6100 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6100 |
| Ubuntu:25.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-6100 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-6100 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-6100 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | UBUNTU-CVE-2026-6100 |
| Ubuntu:22.04:LTS | python3.10 | 3.10.12-1~22.04.16 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | USN-8509-1 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.15 | UBUNTU-CVE-2026-6100 |
| Ubuntu:25.10 | python3.13 | no fix listed | UBUNTU-CVE-2026-6100 |
| Ubuntu:25.10 | python3.14 | no fix listed | UBUNTU-CVE-2026-6100 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | USN-8509-1 |
| Ubuntu:26.04:LTS | python3.14 | 3.14.4-1ubuntu0.1 | UBUNTU-CVE-2026-6100 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.10.213.11.0 – before 3.11.163.12.0 – before 3.12.143.13.0 – before 3.13.143.14.0a1 – before 3.14.5rc13.15.0a1 – before 3.15.0b1 |
Weakness: CWE-416, CWE-787, CWE-825 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/python/cpython/pull/148396 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/ vendor-advisory
- https://github.com/python/cpython/issues/148395 issue-tracking
- https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d patch
- https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 patch
- https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20 patch
- https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e patch
- https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b patch
- https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3 patch
- http://www.openwall.com/lists/oss-security/2026/04/13/10
- https://access.redhat.com/security/cve/CVE-2026-6100 vdb-entry, x_refsource_REDHAT
- RHBZ#2457932 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:52400 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13812 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:16699 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10711 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19064 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19019 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11077 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11062 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10950 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19590 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17619 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19549 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26187 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19571 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19570 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13692 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21682 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14653 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17525 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19576 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14652 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14656 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10949 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10774 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10745 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19216 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19175 vendor-advisory, x_refsource_REDHAT