CVE-2026-11972

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.(CVE-2026-8328)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.(CVE-2026-8328)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.(CVE-2026-3276)

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.(CVE-2026-8328)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.(CVE-2026-3276)

The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.(CVE-2026-8328)

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.(CVE-2026-0864)

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.  The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory.  This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330.(CVE-2026-11940)

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.(CVE-2026-11972)

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree.

On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '....', which results in a landmark of '....\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative Lib folder that will be discovered by an otherwise restricted install.

Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive.

Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new Python install manager to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a Modules directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources.

Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory.

The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so…

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

• CVE-2026-6100: clear dangling next_in pointer after MemoryError in bz2/lzma decompress to avoid use-after-free on decompressor reuse
• CVE-2026-11972: break tarfile._Stream.seek block-skip loop at EOF to avoid a hang on crafted streaming archives

• CVE-2026-6100: clear dangling next_in pointer after MemoryError in bz2/lzma decompress to avoid use-after-free on decompressor reuse
• CVE-2026-11972: break tarfile._Stream.seek block-skip loop at EOF to avoid a hang on crafted streaming archives

• CVE-2026-11972: break tarfile._Stream.seek block-skip loop at EOF to avoid a hang on crafted streaming archives

• CVE-2026-11972: break tarfile._Stream.seek block-skip loop at EOF to avoid a hang on crafted streaming archives

• CVE-2026-11972: break tarfile._Stream.seek block-skip loop at EOF to avoid a hang on crafted streaming archives

• CVE-2026-11972: break the block-skip loop in tarfile _Stream.seek() at EOF, so a crafted stream-mode archive declaring a huge member size no longer makes archive parsing take exponentially longer

• CVE-2026-11972: stop tarfile._Stream.seek() from spinning past end of stream - the loop read whole blocks according to the member size declared in the header and ignored what read() returned, so a header announcing a huge size (e.g. 2**64) kept it going against an already exhausted stream and hung any application walking an untrusted archive opened in streaming mode (mode='r|'). Backported from upstream CPython (gh-151981, GH-151982).

• CVE-2026-11972: fix an unbounded loop (CPU DoS) in the tarfile module when a member header in a streaming-mode archive (mode="r|") declares a huge size, by breaking out of the _Stream.seek() read loop at EOF

• CVE-2026-11972: fix an unbounded loop (CPU DoS) in the tarfile module when a member header in a streaming-mode archive (mode="r|") declares a huge size, by breaking out of the _Stream.seek() read loop at EOF

• Re-tag base release to 94.0.5 to align NVR with Oracle Linux errata; no code or security content changes — this build already contains all fixes shipped in Oracle's 2.7.5-94.0.5.el7_9

• SECURITY UPDATE: configuration file injection via carriage returns in written option values
  • debian/patches/CVE-2026-0864.patch: normalise CR and CRLF, and not only LF, into '\n\t' continuation lines when writing option values in RawConfigParser.write() in Lib/ConfigParser.py, so that an attacker-controlled value can no longer inject additional sections, keys and values into the written file
  • CVE-2026-0864
• SECURITY UPDATE: CPU denial-of-service in tarfile streaming mode via a member size declared past the end of the stream
  • debian/patches/CVE-2026-11972.patch: stop _Stream.seek() at the first empty read instead of looping once per attacker-declared block against an already-exhausted stream in Lib/tarfile.py
  • CVE-2026-11972

• CVE-2026-11972: break tarfile._Stream.seek block-skip loop at EOF to avoid a hang on crafted streaming archives

• CVE-2026-6100: clear dangling next_in pointer after MemoryError in bz2/lzma decompress to avoid use-after-free on decompressor reuse
• CVE-2026-11972: break tarfile._Stream.seek block-skip loop at EOF to avoid a hang on crafted streaming archives

• SECURITY UPDATE: quadratic parse time in the tarfile module when a streaming archive declares an offset past the end of the stream
  • debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in _Stream.seek() as soon as read() returns no data, in Lib/tarfile.py, so a crafted mode="r|" archive can no longer keep the parser reading an exhausted stream.
  • CVE-2026-11972

• SECURITY UPDATE: quadratic parse time in the tarfile module when a streaming archive declares an offset past the end of the stream
  • debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in _Stream.seek() as soon as read() returns no data, in Lib/tarfile.py, so a crafted mode="r|" archive can no longer keep the parser reading an exhausted stream.
  • CVE-2026-11972
• SECURITY UPDATE: out-of-bounds write when a bz2 decompressor is reused after a decompression error
  • debian/patches/CVE-2026-9669.patch: record the libbzip2 error in the BZ2Decompressor object and refuse any further decompress() call with ValueError, in Modules/_bz2module.c, so retrying with the same object can no longer re-enter BZ2_bzDecompress() on a bz_stream left in an invalid internal state.
  • CVE-2026-9669

• SECURITY UPDATE: quadratic parse time in the tarfile module when a streaming archive declares an offset past the end of the stream
  • debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in _Stream.seek() as soon as read() returns no data, in Lib/tarfile.py, so a crafted mode="r|" archive can no longer keep the parser reading an exhausted stream.
  • CVE-2026-11972
• SECURITY UPDATE: out-of-bounds write when a bz2 decompressor is reused after a decompression error
  • debian/patches/CVE-2026-9669.patch: record the libbzip2 error in the BZ2Decompressor object and refuse any further decompress() call with ValueError, in Modules/_bz2module.c, so retrying with the same object can no longer re-enter BZ2_bzDecompress() on a bz_stream left in an invalid internal state.
  • CVE-2026-9669

• SECURITY UPDATE: quadratic parse time in the tarfile module when a streaming archive declares an offset past the end of the stream
  • debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in _Stream.seek() as soon as read() returns no data, in Lib/tarfile.py, so a crafted mode="r|" archive can no longer keep the parser reading an exhausted stream.
  • CVE-2026-11972

• CVE-2026-87910: tarfile: skip a link member when the extraction filter returns None for its hardlink-extraction fallback instead of ignoring the filter result
• CVE-2026-17084: stringprep: build the RFC 3454 B.2/B.3 tables from Unicode 3.2.0 data so IDNA 2003 encoding of newly case-folding characters no longer depends on the interpreter's Unicode version
• CVE-2026-15310: zipfile: bound the output of each bzip2/LZMA decompress() call so a small crafted member cannot trigger an unbounded allocation
• CVE-2026-9669: bz2: refuse to reuse a BZ2Decompressor after a decompression error, so retrying with the same object can no longer resume from an invalid internal state and write out of bounds
• CVE-2026-11972: tarfile: stop the streaming-mode seek() loop at EOF so a member header declaring a huge size no longer makes parsing take exponentially longer

• CVE-2026-11972: stop tarfile._Stream.seek() looping over the declared block count once the stream is at EOF, so a crafted header advertising a huge member size can no longer make a streaming-mode read take exponentially longer
• CVE-2026-9669: latch the libbz2 error in BZ2Decompressor and refuse further use with ValueError, so an application that retries a decompressor after an OSError can no longer re-enter BZ2_bzDecompress() on invalid internal state and drive out-of-bounds writes to a stack buffer

• SECURITY UPDATE: CPU denial-of-service in tarfile streaming mode via a crafted archive that declares more blocks than it contains
  • debian/patches/CVE-2026-11972.patch: in Lib/tarfile.py, break out of the block loop in _Stream.seek() once read() returns no data, so an archive opened in streaming mode (mode='r|') can no longer make parsing take exponentially longer by declaring a block count past end of file. Backport of upstream commit 3f031d431f80 (gh-151981 / GH-151982), taken unchanged from this package's amazonlinux2els branch where it was adapted for 3.7 by Qiantong Zhong [email protected]. Bundles the upstream regression test test_getmembers_big_size (test_tarfile.py).
  • CVE-2026-11972
• SECURITY UPDATE: out-of-bounds stack write when a bz2 decompressor is reused after a decompression error
  • debian/patches/CVE-2026-9669.patch: in Modules/_bz2module.c, record the libbz2 error code on BZ2Decompressor and raise ValueError on any further decompress() call, so an application that catches the OSError and retries with the same decompressor can no longer make it resume from an invalid internal state and write out of bounds to a stack buffer. Backport of upstream commit 938ec030e90c (gh-150599 / GH-150600) via the 3.10 backport; self->bzerror = 0; is placed by hand in _bz2_BZ2Decompressor___init___impl(), whose lock-allocation prologue differs in this version. Bundles the upstream regression test test_decompress_after_data_error (test_bz2.py).
  • CVE-2026-9669

• CVE-2026-11972: break out of the block loop in tarfile._Stream.seek as soon as read() returns no data, so a member header declaring a huge size can no longer keep a stream-mode archive spinning until it is interrupted
• CVE-2026-9669: latch the libbz2 error code in BZ2Decomp_decompress and raise ValueError on any later call, so a BZ2Decompressor cannot be re-entered after a decompression error and write outside its output buffer; the same error is latched on BZ2FileObject through the new Util_BzRead wrapper, so a BZ2File whose stream already errored re-reports that IOError on every later read instead of re-entering BZ2_bzDecompress

• CVE-2026-11972: break out of the block loop in tarfile._Stream.seek as soon as read() returns no data, so a member header declaring a huge size can no longer keep a stream-mode archive spinning until it is interrupted
• CVE-2026-9669: latch the libbz2 error code in BZ2Decomp_decompress and raise ValueError on any later call, so a BZ2Decompressor cannot be re-entered after a decompression error and write outside its output buffer; the same error is latched on BZ2FileObject through the new Util_BzRead wrapper, so a BZ2File whose stream already errored re-reports that IOError on every later read instead of re-entering BZ2_bzDecompress

• SECURITY UPDATE: CPU denial of service via unbounded block skipping past end of stream in tarfile
  • debian/patches/CVE-2026-11972.patch: break out of the block skipping loop in _Stream.seek() as soon as read() returns no data in Lib/tarfile.py, so an attacker declared member size can no longer make parsing a stream mode ("r|") archive take exponentially longer; add regression test to Lib/test/test_tarfile.py
  • CVE-2026-11972
• SECURITY UPDATE: Out-of-bounds write when a bz2 decompressor or a BZ2File handle is reused after a decompression error
  • debian/patches/CVE-2026-9669.patch: record the failing libbz2 error code on BZ2DecompObject and refuse any further decompress() call with ValueError in Modules/bz2module.c, so crafted input can no longer make BZ2_bzDecompress() resume from an invalid internal state and write out of bounds to a stack buffer; also make the error sticky for the C BZ2File read paths, which re-entered the errored stream in the same way; add regression tests for both to Lib/test/test_bz2.py
  • CVE-2026-9669

• CVE-2026-11972: break out of the block loop in tarfile._Stream.seek as soon as read() returns no data, so a member header declaring a huge size can no longer keep a stream-mode archive spinning until it is interrupted
• CVE-2026-9669: latch the libbz2 error code in BZ2Decomp_decompress and raise ValueError on any later call, so a BZ2Decompressor cannot be re-entered after a decompression error and write outside its output buffer; the same error is latched on BZ2FileObject through the new Util_BzRead wrapper, so a BZ2File whose stream already errored re-reports that IOError on every later read instead of re-entering BZ2_bzDecompress

These are all security issues fixed in the python310-3.10.20-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.15-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.13-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~b4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.14-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.7-1.1 package on the GA media of openSUSE Tumbleweed.