Is CVE-2026-11972 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11972 being exploited in the wild.

How severe is CVE-2026-11972?

Informational severity, with a CVSS score of 8.2, published 23 June 2026.

Which products and versions are affected?

Python Software Foundation CPython < 3.16.0.

Is there a fix for CVE-2026-11972?

A patch was published on 2026-06-23: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11972 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11972?

Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11972: Python CPython infinite loop in tarfile streaming mode

Q: Is there a fix for CVE-2026-11972?

A patch was published on 2026-06-23: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-11972 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-11972?

Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11972 · Severity: info · CVSS 8.2 · Published 2026-06-23

A vulnerability in Python's standard library could allow an attacker to cause a denial-of-service condition. By providing a specially crafted archive file to an application that processes data in 'streaming mode,' an attacker can trigger an infinite loop. This would cause the application to hang, consuming system resources and potentially making the service unavailable to legitimate users.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2026-11972 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11972 being exploited in the wild.
How severe is CVE-2026-11972?: Informational severity, with a CVSS score of 8.2, published 23 June 2026.
Which products and versions are affected?: Python Software Foundation CPython < 3.16.0.
Is there a fix for CVE-2026-11972?: A patch was published on 2026-06-23: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11972 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11972?: Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the CPython 'tarfile' module within the '_Stream.seek' routine. When an archive is opened in streaming mode (mode='r|'), the forward-seek implementation fails to validate the return value of read operations against the End of File (EOF). Consequently, if a seek operation is requested that exceeds the remaining data, the module enters an infinite loop attempting to read non-existent blocks. An attacker can exploit this by providing a crafted tar archive that triggers this condition, leading to resource exhaustion and a Denial of Service (DoS). The issue is tracked as CWE-252 (Unchecked Return Value) and CWE-606 (Unchecked Input for Loop Condition). Patches have been developed for all active CPython branches from 3.10 through 3.15.

Affected products

Python Software Foundation CPython < 3.16.0

Timeline

2026-06-16: other: Initial fix developed in CPython repository
2026-06-23: disclosed: Issue publicly reported on GitHub
2026-06-23: patched: Fix merged into CPython main branch
2026-06-23: advisory: CVE-2026-11972 published
2026-06-24: advisory: Security announcement sent to Python mailing list

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.