Executive brief
A vulnerability in Python's standard library could allow an attacker to cause a denial-of-service condition. By providing a specially crafted archive file to an application that processes data in 'streaming mode,' an attacker can trigger an infinite loop. This would cause the application to hang, consuming system resources and potentially making the service unavailable to legitimate users.
Technical details
A vulnerability exists in the CPython 'tarfile' module within the '_Stream.seek' routine. When an archive is opened in streaming mode (mode='r|'), the forward-seek implementation fails to validate the return value of read operations against the End of File (EOF). Consequently, if a seek operation is requested that exceeds the remaining data, the module enters an infinite loop attempting to read non-existent blocks. An attacker can exploit this by providing a crafted tar archive that triggers this condition, leading to resource exhaustion and a Denial of Service (DoS). The issue is tracked as CWE-252 (Unchecked Return Value) and CWE-606 (Unchecked Input for Loop Condition). Patches have been developed for all active CPython branches from 3.10 through 3.15.
Affected products
- Python Software Foundation CPython < 3.16.0
Timeline
- 2026-06-16: other: Initial fix developed in CPython repository
- 2026-06-23: disclosed: Issue publicly reported on GitHub
- 2026-06-23: patched: Fix merged into CPython main branch
- 2026-06-23: advisory: CVE-2026-11972 published
- 2026-06-24: advisory: Security announcement sent to Python mailing list