CVE-2026-55206: miurahr py7zr denial of service in PackInfo header parsing

CVE-2026-55206 · Severity: medium · CVSS 4 · Published 2026-07-08

py7zr is a Python library used to compress and decompress 7zip archives. A vulnerability in how the library reads archive headers allows a specially crafted file to consume excessive CPU resources, leading to a denial-of-service (DoS) condition. This occurs as soon as the file is opened, even if the user does not attempt to extract its contents, potentially crashing or slowing down applications that process untrusted 7zip files.

Technologies: py7zr (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55206 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55206 being exploited in the wild.
How severe is CVE-2026-55206?
Medium severity, with a CVSS score of 4, published 8 July 2026.
Which products and versions are affected?
py7zr (PyPI) <= 1.1.2, ECOSYSTEM:introduced=0,fixed=1.1.3.
Is there a fix for CVE-2026-55206?
Yes. py7zr (PyPI): upgrade to 1.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55206 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55206?
Check whether you run py7zr (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • py7zr (PyPI): upgrade to 1.1.3 or later
    pip install "py7zr>=1.1.3"

Technical details

A denial-of-service vulnerability exists in py7zr due to inefficient algorithmic complexity (CWE-407) in the `PackInfo._read()` method within `archiveinfo.py`. The component uses a cumulative sum pattern to calculate `packpositions` based on the `numstreams` value provided in the archive header. Because `numstreams` is attacker-controlled and the calculation re-sums the list for every element, an attacker can provide a crafted header that triggers O(n^2) CPU work. This occurs during the `SevenZipFile.init()` phase, meaning the impact is triggered upon opening the file without requiring extraction. The issue is resolved in version 1.1.3 by implementing `itertools.accumulate` for O(n) complexity and enforcing `numstreams` validation.

Affected products

  • miurahr py7zr < 1.1.3

Identifiers

  • CVE-2026-55206
  • GHSA-h4gh-22qq-72r7
  • PYSEC-2026-2973

Timeline

  • 2026-06-19: patched: Version 1.1.3 released
  • 2026-06-19: advisory: GitHub Security Advisory GHSA-h4gh-22qq-72r7 published
  • 2026-07-08: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.