In Python’s tarfile module, a bug in streaming mode (mode="r|") caused the module to fail to detect end-of-file correctly, leading to an infinite parsing loop. The controlled loop can consume CPU resources until the process terminates or the system becomes unresponsive, effectively degrading availability. The weakness aligns with unchecked return values and unchecked conditions, as well as resource exhaustion when no limit is set.

Python Software Foundation CPython instances that use the tarfile module in streaming mode and are running a version released prior to the issued fix. The specific version is not enumerated in the advisory, but any CPython install where the bug exists until the patch is applied is affected.

A CVSS score of 8.2 signals a high severity risk; the vulnerability is exploitable via a crafted tar archive that the application processes with tarfile in streaming mode. The EPSS score is currently unavailable, and the flaw is not listed in CISA’s KEV catalog. Attack can trigger the denial of service by providing malformed archives from any source the vulnerable application reads, making the vector likely local or remote depending on exposure.