PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11972 Python Software Foundation CVE debrief

The Python tarfile module is vulnerable to a denial-of-service (DoS) attack when using streaming mode. The module does not properly handle end-of-file (EOF), causing archive parsing to consume excessive resources and time. This issue has been assigned a CVSS score of 8.2 and is considered high severity. The vulnerability was published on June 23, 2026, and last modified on June 25, 2026.

Vendor
Python Software Foundation
Product
CPython
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-08-13
Advisory published
2026-06-23
Advisory updated
2026-08-13

Who should care

Developers and administrators using the Python tarfile module, especially in applications that handle untrusted or user-supplied archives, should be aware of this vulnerability. Additionally, organizations using Python-based systems or services that rely on the tarfile module for archive processing should prioritize patching or mitigating this issue.

Technical summary

The tarfile module in Python does not properly handle end-of-file (EOF) when using streaming mode (mode='r|'). This can cause archive parsing to take exponentially longer, leading to a denial-of-service (DoS) condition. The issue is due to the module's inability to detect and handle EOF correctly, resulting in excessive resource consumption. The vulnerability has a CVSS score of 8.2 and is classified as high severity.

Defensive priority

This vulnerability should be prioritized for patching or mitigation, especially in systems or applications that handle untrusted or user-supplied archives. Developers and administrators should ensure that the tarfile module is updated to a version that includes the fix.

Recommended defensive actions

  • Update the Python tarfile module to a patched version.
  • Implement input validation and sanitization for archive files.
  • Use alternative archive processing libraries or tools.
  • Monitor system resources and archive processing times for anomalies.
  • Consider implementing rate limiting or resource quotas for archive processing.

Evidence notes

The vulnerability was reported by an unknown vendor and is tracked under the identifier CVE-2026-11972. The NVD entry provides additional details, including the CVSS vector and weaknesses (CWE-252, CWE-606, CWE-770).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11972 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11972

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11972 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11972

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.