Back to overview

CVE-2026-11972

HIGH
8.2
CVSS 4.0
Description
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.

Metadata

CVE ID
CVE-2026-11972
State
PUBLISHED
Assigner
PSF
Reserved
2026-06-11 11:35 UTC
Published
2026-06-23 22:02 UTC
Last updated
2026-06-23 22:02 UTC
Primary CWE
CWE-252
CWE-252
Vendor / Product
Python Software Foundation / CPython
Sources
cve.org  ·  NVD

Severity & Metrics

8.2 HIGH CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
Python Software Foundation CPython — 0 < 3.16.0
Weakness (CWE)
CWESourceDescription
CWE-252 cna CWE-252
CWE-606 cna CWE-606
CWE-770 cna CWE-770
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.2 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References (3)
Back to overview