Is CVE-2026-6100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6100 being exploited in the wild.

How severe is CVE-2026-6100?

High severity, with a CVSS score of 8.1, published 13 April 2026.

Which products and versions are affected?

Python Software Foundation CPython 3.10, 3.11, 3.13, 3.14.

Is there a fix for CVE-2026-6100?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6100 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6100?

Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6100: Python CPython use-after-free in decompression modules

CVE-2026-6100 · Severity: high · CVSS 8.1 · Published 2026-04-13

A vulnerability in Python's standard library could allow an attacker to cause a system crash or potentially execute unauthorized code when the system is under heavy memory pressure. This occurs when specific data decompression tools (LZMA, BZ2, and Gzip) are reused after a memory failure, leading to the use of corrupted memory pointers. Applications that decompress untrusted data and reuse decompression objects are at the highest risk.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2026-6100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6100 being exploited in the wild.
How severe is CVE-2026-6100?: High severity, with a CVSS score of 8.1, published 13 April 2026.
Which products and versions are affected?: Python Software Foundation CPython 3.10, 3.11, 3.13, 3.14.
Is there a fix for CVE-2026-6100?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6100 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6100?: Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in Python's `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `zlib._ZlibDecompressor` classes. The flaw is triggered when a memory allocation fails (raising a `MemoryError`) during a decompression operation, leaving a dangling pointer in the decompressor instance. If the same instance is subsequently reused for another decompression call, the process may read or write through this stale pointer. This can lead to arbitrary code execution or a denial-of-service (crash). The vulnerability is only exploitable if the application catches the `MemoryError` and continues to use the same decompressor object; one-shot helper functions like `lzma.decompress()` are not affected.

Affected products

Python Software Foundation CPython 3.10, 3.11, 3.13, 3.14

Timeline

2026-04-13: advisory: Initial disclosure and NVD publication
2026-04-13: disclosed: Public disclosure via oss-security list

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.