Executive brief
py7zr is a Python library used for compressing and decompressing 7zip archives. A vulnerability in how it handles file extraction allows a specially crafted, small archive to expand into a massive amount of data upon decompression. This can lead to a denial-of-service by completely exhausting the target system's disk space or memory, potentially crashing applications or the entire server.
Technical details
A data amplification vulnerability (CWE-409) exists in py7zr's Worker.decompress() function. The component extracts archive entries without monitoring the cumulative decompressed size, allowing a 'zip bomb' attack where a small malicious archive (e.g., 15 KB) expands to a much larger size (e.g., 100 MB or more) during processing. An attacker can exploit this by providing a crafted .7z file to an application using the library, leading to a Denial of Service (DoS) via disk or memory exhaustion. The fix, introduced in version 1.1.3, implements a max_extract_size parameter and tracks cumulative bytes during extraction to raise a DecompressionBombError if limits are exceeded.
Affected products
- miurahr py7zr <= 1.1.2
Timeline
- 2026-06-19: patched: Version 1.1.3 released to address the vulnerability.
- 2026-06-19: advisory: GitHub Security Advisory GHSA-gjrg-mpp7-g774 published.
- 2026-07-08: disclosed: CVE-2026-55195 published to the NVD.