CVE-2026-11972

tarfile opened in streaming mode mishandles EOF

Published Jun 23, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

Analysis

Technical impact

In Python’s tarfile module, a bug in streaming mode (mode="r|") causes the EOF to be handled incorrectly, making archive parsing continue for an exponentially long period. When a tarfile is processed in this mode, the module fails to stop at the actual end of the archive, leading to excessive CPU utilization and an infinite loop (CWE-835) that persists until system resources are exhausted or a timeout occurs. The impact is a denial of service on the process or the host.

Affected Systems

Python Software Foundation CPython instances that use the tarfile module in streaming mode and are running a version released prior to the issued fix. The specific version is not enumerated in the advisory, but any CPython install where the bug exists until the patch is applied is affected.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity. The flaw can be triggered by supplying a crafted tar archive that the application reads with tarfile in streaming mode, and it is not listed in CISA’s KEV catalog. Attackers can induce a denial of service by feeding a malformed archive from any source that the vulnerable process ingests, potentially remotely if the process accepts user‑supplied archives over a network. The EPSS score of < 1% indicates a very low but non‑zero probability that the vulnerability will be actively exploited in the wild.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Python Software Foundation

CPython

unaffected

Version	Status	Constraints
`0`	affected	< 3.10.21
`3.11.0`	affected	< 3.11.16
`3.12.0`	affected	< 3.12.14
`3.13.0`	affected	< 3.13.15
`3.14.0`	affected	< 3.14.7
`3.15.0a1`	affected	< 3.15.0b4

No data.

Vendor Product Versions

Python

Cpython

Version	Status	Scheme	Platform
`[0,3.16.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest CPython release that contains the tarfile streaming mode EOF fix.
Avoid processing untrusted tar files with streaming mode; use a safer reading mode or restrict input sources.
If upgrading immediately is not possible, temporarily disable or refuse to open tar archives with mode="r|", or sanitize input before passing to tarfile.

Generated by OpenCVE AI on June 30, 2026 at 01:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.715% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438
https://github.com/python/cpython/issues/151981
https://github.com/python/cpython/pull/151982
https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
https://nvd.nist.gov/vuln/detail/CVE-2026-11972
https://www.cve.org/CVERecord?id=CVE-2026-11972

History

Aug 5, 2026 1:00 AM Added references View changes

Type	Values Removed	Values Added
References		https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438

Jun 30, 2026 4:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9 https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365 https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21 https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192 https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896

Jun 30, 2026 12:45 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://nvd.nist.gov/vuln/detail/CVE-2026-11972 https://www.cve.org/CVERecord?id=CVE-2026-11972
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jun 24, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 24, 2026 2:30 PM Description updated. References updated View changes

Type	Values Removed	Values Added
Description	When using the "tarfile" module with a file opened in "streaming mode" (mode="r\|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.	When using the "tarfile" module with a file opened in "streaming mode" (mode="r\|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
References	https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9 https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365 https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896

Jun 24, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9 https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365 https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896

Jun 24, 2026 1:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Python Python cpython
Vendors & Products		Python Python cpython

Jun 23, 2026 10:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		When using the "tarfile" module with a file opened in "streaming mode" (mode="r\|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.
Title		tarfile opened in streaming mode mishandles EOF
Weaknesses		CWE-252 CWE-606 CWE-770
References		https://github.com/python/cpython/issues/151981 https://github.com/python/cpython/pull/151982 https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`