CVE-2026-9669

EUVD-2026-35202
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
PSFCNA
8.2 HIGH
NETWORK
HIGH
NONE
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
pythoncpython
𝑥
< 3.13.14
CNA
pythoncpython
3.14.0 ≤
𝑥
< 3.14.6
CNA
Debian logo
Debian Releases
Debian Product
Codename
python3.11
bookworm
no-dsa
bookworm (security)
vulnerable
python3.13
forky
3.13.14-1
fixed
sid
3.13.14-1
fixed
trixie
3.13.5-2+deb13u3
fixed
python3.14
forky
3.14.6-1
fixed
sid
3.14.6-1
fixed
python3.9
bullseye
postponed
bullseye (security)
vulnerable
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-unversioned-command
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-debug
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-devel
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-idle
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-libs
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-test
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3-tkinter
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3.11
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debug
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debuginfo
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-debugsource
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-devel
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-idle
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-libs
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-test
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.11-tkinter
Amazon Linux 2023
0:3.11.15-1.amzn2023.0.4
fixed
python3.12
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debug
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debuginfo
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-debugsource
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-devel
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-idle
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-libs
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-test
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.12-tkinter
Amazon Linux 2023
0:3.12.13-2.amzn2023.0.4
fixed
python3.13
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debuginfo
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-debugsource
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-devel
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-freethreading
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-freethreading-debug
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-idle
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-libs
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-test
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.13-tkinter
Amazon Linux 2023
0:3.13.14-1.amzn2023.0.1
fixed
python3.9-debuginfo
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
python3.9-debugsource
Amazon Linux 2023
0:3.9.25-1.amzn2023.0.8
fixed
Common Weakness Enumeration
References
https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6
https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e
https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f
https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79
https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d
https://github.com/python/cpython/issues/150599
https://github.com/python/cpython/pull/150600
https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/
http://www.openwall.com/lists/oss-security/2026/06/08/17