CVE-2026-11972: tarfile opened in streaming mode mishandles EOF
Awaiting analysis
AliasesALPINE-CVE-2026-11972RHSA-2026:35806RHSA-2026:35807RHSA-2026:35812RHSA-2026:35813UBUNTU-CVE-2026-11972DEBIAN-CVE-2026-11972CGA-29x2-h669-f2hxCGA-3g7p-9qvq-83m3CGA-498m-q8g7-j6w8CGA-55jf-rmq5-v8vmCGA-c8vx-jqg6-gc5hCGA-hw8r-qxr7-v53xCGA-m586-cxjf-9w4pCGA-w287-q9rf-58j3CGA-w2cw-v85q-v9prCGA-wphf-rqvv-m5vj
Published 23-06-2026Last modified 13-08-2026
Vulnerability summary
CVE-2026-11972 is a high (CVSS 8.2) Unchecked Return Value vulnerability in python software foundation cpython. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.8% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 8.2 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 04-11-2026)
Source freshness unavailable
How is this decided?CVSS score
8.2/10
010
High · v4.0 (CVE.org)EPSS score
0.71%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 32 · Related 31OPENSUSE-SU-2026:11426-1OPENSUSE-SU-2026:11427-1OPENSUSE-SU-2026:11428-1OPENSUSE-SU-2026:11429-1OPENSUSE-SU-2026:11534-1OPENSUSE-SU-2026:11597-1OPENSUSE-SU-2026:21595-1RHSA-2026:54534RHSA-2026:54554SUSE-SU-2026:23159-1SUSE-SU-2026:23191-1SUSE-SU-2026:23212-1SUSE-SU-2026:23303-1SUSE-SU-2026:23743-1SUSE-SU-2026:3530-1SUSE-SU-2026:3548-1SUSE-SU-2026:3560-1SUSE-SU-2026:3569-1SUSE-SU-2026:3601-1SUSE-SU-2026:3635-1SUSE-SU-2026:3649-1SUSE-SU-2026:3855-1SUSE-SU-2026:3862-1SUSE-SU-2026:4174-1SUSE-SU-2026:4534-1SUSE-SU-2026:4580-1SUSE-SU-2026:4581-1SUSE-SU-2026:4582-1SUSE-SU-2026:4583-1SUSE-SU-2026:4584-1SUSE-SU-2026:4585-1SUSE-SU-2026:4754-1CGA-WP44-6JJX-9FC4
Timeline
- 23-06-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
CVSS metrics
8 scores · 8 sources · 2 versionsHigh 8.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.5Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesSingle source
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.71% on 05-10-2026
05-10-202604-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-252Unchecked Return ValueThe product does not check the return value from a method or function.
- CWE-606Unchecked Input for Loop ConditionThe product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat37 products
- python3.11< 0:3.11.15-4.4.hum1
- python3.11-debug< 0:3.11.15-4.4.hum1
- python3.11-devel< 0:3.11.15-4.4.hum1
- python3.11-idle< 0:3.11.15-4.4.hum1
- python3.11-libs< 0:3.11.15-4.4.hum1
Ubuntu12 products
- python2.7All versions (No fix recorded)
- python3.10All versions (No fix recorded)
- python3.11All versions (No fix recorded)
- python3.12All versions (No fix recorded)
- python3.13All versions (No fix recorded)
Chainguard5 products
- python-3.10< 3.10.20-r10
- python-3.11< 3.11.15-r8
- python-3.12< 3.12.13-r10
- python-3.13< 3.13.14-r2
- python-3.14< 3.14.6-r3
Wolfi5 products
- python-3.10< 3.10.20-r10
- python-3.11< 3.11.15-r8
- python-3.12< 3.12.13-r10
- python-3.13< 3.13.14-r2
- python-3.14< 3.14.6-r3
Debian4 products
- pypy3All versions (No fix recorded) | < 8.0.0+dfsg-1
- python3.11All versions (No fix recorded)
- python3.13< 3.13.15-1 | < 3.13.5-2+deb13u5
- python3.14< 3.14.7-1
Alpine1 product
- python3< 3.12.14-r0 | < 3.14.7-r0
Python software foundation1 product
- cpython< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.15 | ≥ 3.14.0, < 3.14.7 | ≥ 3.15.0a1, < 3.15.0b4
7 vendors · 65 products
References
29 links- mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/Vendor AdvisoryARTICLEREPORTAdvisory
Show all 29 references
- images.redhat.comARTICLE
- github.com/python/cpythonPACKAGE