CVE-2026-11972

EUVD-2026-38630
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PSFCNA
8.2 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 36.59%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
pythoncpython
𝑥
< 3.13.15
CNA
pythoncpython
3.14.0 ≤
𝑥
< 3.14.7
CNA
Debian logo
Debian Releases
Debian Product
Codename
pypy3
bookworm
postponed
bullseye
postponed
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
python2.7
bullseye
vulnerable
python3.11
bookworm
postponed
bookworm (security)
vulnerable
python3.13
forky
vulnerable
sid
vulnerable
trixie
no-dsa
python3.14
forky
vulnerable
sid
vulnerable
python3.9
bullseye
postponed
bullseye (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python2.7
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.4
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
python3.5
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
python3.6
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.7
bionic
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.8
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.9
focal
needs-triage
jammy
dne
noble
dne
questing
dne
resolute
dne
python3.10
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
python3.11
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
python3.12
jammy
dne
noble
needs-triage
questing
dne
resolute
dne
python3.13
jammy
dne
noble
dne
questing
ignored
resolute
dne
python3.14
jammy
dne
noble
dne
questing
ignored
resolute
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
python-debug
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
python-debuginfo
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
python-devel
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
python-libs
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
python-test
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
python-tools
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
python-unversioned-command
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-debug
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-debuginfo
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
python3-devel
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-idle
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-libs
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-test
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-tkinter
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-tools
Amazon Linux 2
0:3.7.16-1.amzn2.0.28
fixed
python3.11
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debug
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debuginfo
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debugsource
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-devel
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-idle
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-libs
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-test
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-tkinter
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.12
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debug
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debuginfo
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debugsource
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-devel
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-idle
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-libs
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-test
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-tkinter
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.13
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-debuginfo
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-debugsource
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-devel
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-freethreading
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-freethreading-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-idle
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-libs
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-test
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.13-tkinter
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.2
fixed
python3.14
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-debug
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-debuginfo
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-debugsource
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-devel
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-freethreading
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-freethreading-debug
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-freethreading-devel
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-freethreading-idle
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-freethreading-libs
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-freethreading-test
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-freethreading-tkinter
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-idle
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-libs
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-test
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.14-tkinter
Amazon Linux 2023
0:3.14.6-1.amzn2023.0.2
fixed
python3.9-debuginfo
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3.9-debugsource
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
tkinter
Amazon Linux 2
0:2.7.18-1.amzn2.0.21
fixed
Common Weakness Enumeration
References
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438
https://github.com/python/cpython/issues/151981
https://github.com/python/cpython/pull/151982
https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/