# CVE-2026-6100: Python CPython use-after-free in decompression modules

Source: https://junglewise.ai/threats/cve-2026-6100-python-cpython-use-after-free-in-decompression-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-6100 · Severity: high · CVSS 8.1 · Published 2026-04-13

A vulnerability in Python's standard library could allow an attacker to cause a system crash or potentially execute unauthorized code when the system is under heavy memory pressure. This occurs when specific data decompression tools (LZMA, BZ2, and Gzip) are reused after a memory failure, leading to the use of corrupted memory pointers. Applications that decompress untrusted data and reuse decompression objects are at the highest risk.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2026-6100 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6100 being exploited in the wild.

**How severe is CVE-2026-6100?** High severity, with a CVSS score of 8.1, published 13 April 2026.

**Which products and versions are affected?** Python Software Foundation CPython 3.10, 3.11, 3.13, 3.14.

**Is there a fix for CVE-2026-6100?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6100 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6100?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in Python's `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `zlib._ZlibDecompressor` classes. The flaw is triggered when a memory allocation fails (raising a `MemoryError`) during a decompression operation, leaving a dangling pointer in the decompressor instance. If the same instance is subsequently reused for another decompression call, the process may read or write through this stale pointer. This can lead to arbitrary code execution or a denial-of-service (crash). The vulnerability is only exploitable if the application catches the `MemoryError` and continues to use the same decompressor object; one-shot helper functions like `lzma.decompress()` are not affected.

## Affected products

- Python Software Foundation CPython 3.10, 3.11, 3.13, 3.14

## Timeline

- 2026-04-13: advisory: Initial disclosure and NVD publication
- 2026-04-13: disclosed: Public disclosure via oss-security list

## References

- [https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e](https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e)
- [https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d](https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d)
- [https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2](https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2)
- [https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20](https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20)
- [https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b](https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b)
- [https://github.com/python/cpython/issues/148395](https://github.com/python/cpython/issues/148395)
- [https://github.com/python/cpython/pull/148396](https://github.com/python/cpython/pull/148396)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)