High 8.2Published Jun 23, 2026

CVE-2026-11972tarfile opened in streaming mode mishandles EOF

Updated under an hour ago (Oct 26, 2026, 4:23 PM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

CVSS: 8.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-252, CWE-606, CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Awaiting Analysis
Record last updated: Aug 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.10.21; from 3.11.0 before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.15; from 3.14.0 before 3.14.7; from 3.15.0a1 before 3.15.0b4	CNA record

References

References

https://github.com/python/cpython/issues/151981	issue-tracking
https://github.com/python/cpython/pull/151982	patch
https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/	vendor-advisory
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9	patch
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365	patch
https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21	patch
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec	patch
https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192	patch
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896	patch
https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.