# CVE-2026-55195: miurahr py7zr decompression bomb denial of service in Worker.decompress

Source: https://junglewise.ai/threats/cve-2026-55195-miurahr-py7zr-decompression-bomb-denial-of-service-in-worker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-55195 · Severity: medium · CVSS 4 · Published 2026-07-08

py7zr is a Python library used for compressing and decompressing 7zip archives. A vulnerability in how it handles file extraction allows a specially crafted, small archive to expand into a massive amount of data upon decompression. This can lead to a denial-of-service by completely exhausting the target system's disk space or memory, potentially crashing applications or the entire server.

Technologies: [py7zr (PyPI)](https://junglewise.ai/threats/technologies/py7zr). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55195 being exploited in the wild.

**How severe is CVE-2026-55195?** Medium severity, with a CVSS score of 4, published 8 July 2026.

**Which products and versions are affected?** py7zr (PyPI) <= 1.1.2, ECOSYSTEM:introduced=0,fixed=1.1.3.

**Is there a fix for CVE-2026-55195?** Yes. py7zr (PyPI): upgrade to 1.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55195 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55195?** Check whether you run py7zr (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- py7zr (PyPI): upgrade to 1.1.3 or later

  ```sh
  pip install "py7zr>=1.1.3"
  ```


## Technical details

A data amplification vulnerability (CWE-409) exists in py7zr's Worker.decompress() function. The component extracts archive entries without monitoring the cumulative decompressed size, allowing a 'zip bomb' attack where a small malicious archive (e.g., 15 KB) expands to a much larger size (e.g., 100 MB or more) during processing. An attacker can exploit this by providing a crafted .7z file to an application using the library, leading to a Denial of Service (DoS) via disk or memory exhaustion. The fix, introduced in version 1.1.3, implements a max_extract_size parameter and tracks cumulative bytes during extraction to raise a DecompressionBombError if limits are exceeded.

## Affected products

- miurahr py7zr <= 1.1.2

## Identifiers

- CVE-2026-55195
- GHSA-gjrg-mpp7-g774
- PYSEC-2026-2972

## Timeline

- 2026-06-19: patched: Version 1.1.3 released to address the vulnerability.
- 2026-06-19: advisory: GitHub Security Advisory GHSA-gjrg-mpp7-g774 published.
- 2026-07-08: disclosed: CVE-2026-55195 published to the NVD.

## References

- [https://github.com/miurahr/py7zr/commit/28faf107b64374fa5a02bfb93aa2024e281ca97b](https://github.com/miurahr/py7zr/commit/28faf107b64374fa5a02bfb93aa2024e281ca97b)
- [https://github.com/miurahr/py7zr/releases/tag/v1.1.3](https://github.com/miurahr/py7zr/releases/tag/v1.1.3)
- [https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774](https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774)

## Related threats

- [miurahr py7zr denial of service in PackInfo header parsing](https://junglewise.ai/threats/cve-2026-55206-miurahr-py7zr-denial-of-service-in-packinfo-header-parsing)
- [miurahr py7zr arbitrary file write via symbolic link resolution](https://junglewise.ai/threats/cve-2026-23879-miurahr-py7zr-arbitrary-file-write-via-symbolic-link-resolution)
- [py7zr directory traversal vulnerability](https://junglewise.ai/threats/cve-2022-44900-py7zr-directory-traversal-vulnerability)