Executive brief
py7zr is a Python library used to compress and decompress 7zip archives. A vulnerability in how the library reads archive headers allows a specially crafted file to consume excessive CPU resources, leading to a denial-of-service (DoS) condition. This occurs as soon as the file is opened, even if the user does not attempt to extract its contents, potentially crashing or slowing down applications that process untrusted 7zip files.
Technical details
A denial-of-service vulnerability exists in py7zr due to inefficient algorithmic complexity (CWE-407) in the `PackInfo._read()` method within `archiveinfo.py`. The component uses a cumulative sum pattern to calculate `packpositions` based on the `numstreams` value provided in the archive header. Because `numstreams` is attacker-controlled and the calculation re-sums the list for every element, an attacker can provide a crafted header that triggers O(n^2) CPU work. This occurs during the `SevenZipFile.init()` phase, meaning the impact is triggered upon opening the file without requiring extraction. The issue is resolved in version 1.1.3 by implementing `itertools.accumulate` for O(n) complexity and enforcing `numstreams` validation.
Affected products
- miurahr py7zr < 1.1.3
Timeline
- 2026-06-19: patched: Version 1.1.3 released
- 2026-06-19: advisory: GitHub Security Advisory GHSA-h4gh-22qq-72r7 published
- 2026-07-08: disclosed: CVE published to NVD