CVE-2025-8194

There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. 

This vulnerability can be mitigated by including the following patch after importing the tarfile module:



import tarfile

def _block_patched(self, count):
  if count < 0:  # pragma: no cover
    raise tarfile.InvalidHeaderError("invalid offset")
  return _block_patched._orig_block(self, count)

_block_patched._orig_block = tarfile.TarInfo._block
tarfile.TarInfo._block = _block_patched