Description
py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.
Published: 2026-07-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3. The flaw represents an uncontrolled resource consumption weakness (CWE-409).

Affected Systems

The vulnerability affects the Python library py7zr from the miurahr project. All releases prior to version 1.1.3 are impacted; versions 1.1.3 and later include the fix.

Risk and Exploitability

With a CVSS score of 8.7 the issue carries high severity. The EPSS score of < 1% indicates a very low exploitation probability, and because the vulnerability is not listed in CISA’s KEV catalog, the attack vector is inferred to be any component that unconditionally extracts user‑supplied .7z files, such as web applications, file upload services, or backup utilities. If an attacker can provide a crafted archive, they can overwhelm the target’s storage or memory, leading to service disruption.

Generated by OpenCVE AI on July 26, 2026 at 17:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the py7zr library to version 1.1.3 or later.
  • If upgrading is not immediately possible, implement application‑level checks that enforce a maximum extraction size or resource quota before invoking py7zr.
  • Configure monitoring or alerts for abnormal disk and memory usage during archive extraction to detect and mitigate ongoing attacks.

Generated by OpenCVE AI on July 26, 2026 at 17:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-gjrg-mpp7-g774 py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
History

Thu, 09 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 08 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Miurahr
Miurahr py7zr
Vendors & Products Miurahr
Miurahr py7zr

Wed, 08 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.
Title py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
Weaknesses CWE-409
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Miurahr Py7zr
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-09T14:06:02.499Z

Reserved: 2026-06-16T15:20:43.087Z

Link: CVE-2026-55195

cve-icon Vulnrichment

Updated: 2026-07-09T14:05:45.735Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-08T20:30:58Z

Links: CVE-2026-55195 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T17:15:04Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)