CVE-2026-55195: miurahr py7zr decompression bomb denial of service in Worker.decompress

CVE-2026-55195 · Severity: medium · CVSS 4 · Published 2026-07-08

py7zr is a Python library used for compressing and decompressing 7zip archives. A vulnerability in how it handles file extraction allows a specially crafted, small archive to expand into a massive amount of data upon decompression. This can lead to a denial-of-service by completely exhausting the target system's disk space or memory, potentially crashing applications or the entire server.

Technologies: py7zr (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55195 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55195 being exploited in the wild.
How severe is CVE-2026-55195?
Medium severity, with a CVSS score of 4, published 8 July 2026.
Which products and versions are affected?
py7zr (PyPI) <= 1.1.2, ECOSYSTEM:introduced=0,fixed=1.1.3.
Is there a fix for CVE-2026-55195?
Yes. py7zr (PyPI): upgrade to 1.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55195 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55195?
Check whether you run py7zr (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • py7zr (PyPI): upgrade to 1.1.3 or later
    pip install "py7zr>=1.1.3"

Technical details

A data amplification vulnerability (CWE-409) exists in py7zr's Worker.decompress() function. The component extracts archive entries without monitoring the cumulative decompressed size, allowing a 'zip bomb' attack where a small malicious archive (e.g., 15 KB) expands to a much larger size (e.g., 100 MB or more) during processing. An attacker can exploit this by providing a crafted .7z file to an application using the library, leading to a Denial of Service (DoS) via disk or memory exhaustion. The fix, introduced in version 1.1.3, implements a max_extract_size parameter and tracks cumulative bytes during extraction to raise a DecompressionBombError if limits are exceeded.

Affected products

  • miurahr py7zr <= 1.1.2

Identifiers

  • CVE-2026-55195
  • GHSA-gjrg-mpp7-g774
  • PYSEC-2026-2972

Timeline

  • 2026-06-19: patched: Version 1.1.3 released to address the vulnerability.
  • 2026-06-19: advisory: GitHub Security Advisory GHSA-gjrg-mpp7-g774 published.
  • 2026-07-08: disclosed: CVE-2026-55195 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.