PackInfo._read() in the py7zr library uses an O(n^2) cumulative sum algorithm when parsing the numstreams field from 7z archive headers. Prior to version 1.1.3, this routine handled attacker‑controlled numstreams values without length checks, allowing an adversary to craft a .7z file with large or carefully chosen numstreams values that cause the function to perform excessive CPU cycles during the SevenZipFile.init() stage before any extraction occurs. This can block the host process and deny service. The flaw arises from an algorithmic complexity error (CWE-407).

The vulnerability affects the miurahr:py7zr library in any release prior to version 1.1.3 and processes 7zip archives from untrusted sources, potentially impacting command‑line utilities, scripts, or services that use the library for file archival or extraction.

A CVSS score of 8.7 marks this issue as high severity. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog. A malicious .7z file can be supplied locally or remotely, depending on how the application receives archives. The likely attack vector is the ingestion of a crafted archive that triggers the O(n^2) processing of the numstreams field during SevenZipFile.init(), leading to excessive CPU consumption and possible service interruption.