8.7

CVE-2024-8088: Infinite loop when iterating over zip archive entry names from zipfile.Path

Deferred
AliasesALPINE-CVE-2024-8088RHSA-2024:9371UBUNTU-CVE-2024-8088
Published 22-08-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-8088 is a high (CVSS 8.7) Loop with Unreachable Exit Condition vulnerability in python software foundation cpython. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.9% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 8.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
1.27%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 24 · Related 21
DLA-3980-1DSA-5759-1MGASA-2024-0317OPENSUSE-SU-2024:14434-1OPENSUSE-SU-2025:15713-1RHSA-2024:5962

Timeline

  1. 22-08-2024
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

CVSS metrics

8 scores · 8 sources · 2 versions

EPSS trend

Probability

1.27%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.27% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat11 products
  • python-unversioned-command< 0:3.9.19-8.el9
  • python3< 0:3.9.19-8.el9
  • python3-debug< 0:3.9.19-8.el9
  • python3-devel< 0:3.9.19-8.el9
  • python3-idle< 0:3.9.19-8.el9
Opensuse6 products
  • python310&distro=openSUSE Tumbleweed< 3.10.14-7.1
  • python311&distro=openSUSE Tumbleweed< 3.11.9-7.1
  • python312&distro=openSUSE Tumbleweed< 3.12.5-2.1
  • python313&distro=openSUSE Tumbleweed< 3.13.0~rc1-3.1
  • python38&distro=openSUSE Tumbleweed< 3.8.19-8.1
Ubuntu5 products
  • python3.10< 3.10.12-1~22.04.6
  • python3.11All versions (No fix recorded)
  • python3.12< 3.12.3-1ubuntu0.2
  • python3.8All versions (No fix recorded) | < 3.8.10-0ubuntu1~20.04.12
  • python3.9All versions (No fix recorded)
Chainguard4 products
  • python-3.10< 3.10.14-r6
  • python-3.11< 3.11.9-r8
  • python-3.12< 3.12.5-r1
  • python-3.9< 3.9.20-r0
Debian3 products
  • pypy3All versions (No fix recorded) | < 7.3.18+dfsg-1
  • python3.11< 3.11.2-6+deb12u3
  • python3.13< 3.13.0~rc2-1
Wolfi3 products
  • python-3.10< 3.10.14-r6
  • python-3.11< 3.11.9-r8
  • python-3.12< 3.12.5-r1
Alpine1 product
  • python3< 3.10.14-r2 | < 3.11.8-r1 | < 3.11.9-r1 | < 3.12.3-r2 | < 3.12.5-r1
Python software foundation1 product
  • cpython< 3.8.20 | ≥ 3.9.0, < 3.9.20 | ≥ 3.10.0, < 3.10.15 | ≥ 3.11.0, < 3.11.10 | ≥ 3.12.0, < 3.12.6 | ≥ 3.13.0a1, < 3.13.0rc2

8 vendors · 34 products

References

38 links
Show all 38 references