CVE-2026-11972
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The tarfile module in Python, when used with a file opened in streaming mode (mode="r|"), did not properly handle EOF, causing archive parsing to take exponentially longer.
Risk Assessment
An attacker can provide a specially crafted tar archive that slows down the application using this feature, leading to denial of service (DoS).
Recommendation
Update Python to a version containing the fix for this vulnerability or avoid using streaming mode with untrusted archives.
Other vulnerabilities in Python tarfile module
See all- CVE-2025-4138High
Vulnerability in Python's tarfile module allows the extraction filter to be ignored, enabling symlink targets outside the destination directory and modification of file metadata. Affects TarFile.extractall() or TarFile.extract() with filter='data' or 'tar'.
- CVE-2024-12718Medium
A vulnerability in Python's tarfile module allows modifying file metadata or permissions outside the extraction directory when using filters 'data' or 'tar'. Affects Python 3.12+.
Original NVD description (English source)
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.