The vulnerability resides in CPython’s tarfile module, where parsing a tar archive with a negative member offset triggers an infinite loop and deadlock in the extraction and enumeration APIs. The flaw does not disclose data but prevents the process from completing, effectively hanging the application that attempts to read or list the archive. The severity of the denial of service is reflected in a CVSS score of 7.5 and a CWE‐835 classification of infinite loop.

Python Software Foundation CPython is the affected product. All CPython releases that include the unpatched tarfile implementation are vulnerable, as the security advisory does not specify a limited version set. Systems running Python and using tarfile to extract or inspect uploaded archives are at risk.

Although the exploit requires crafting a malicious tar archive, it can be achieved by an attacker who can trigger tarfile processing – potentially via a file upload interface, command‑line operations, or automated extraction tasks. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at the time of analysis. Still, the infinite loop can consume CPU resources until the process is killed, allowing an attacker to force a denial of service on the target system.