CVE-2026-11972
Detail
Awaiting Enrichment This CVE record has been marked for NVD enrichment efforts.
Description
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CNA: Python Software Foundation
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-252
Unchecked Return Value
Python Software Foundation
CWE-606
Unchecked Input for Loop Condition
Python Software Foundation
CWE-770
Allocation of Resources Without Limits or Throttling
Python Software Foundation
Change History
9 change records found show changes
CVE Modified by Python Software Foundation
8/05/2026 9:16:28 PM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.14.7","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.13.15","versionType":"python","status":"affected"},{"version":"3.14.0","lessThan":"3.14.7","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
CVE Modified by Python Software Foundation
8/05/2026 10:17:00 AM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.14.7","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
CVE Modified by Python Software Foundation
8/04/2026 9:16:44 PM
Action
Type
Old Value
New Value
Added
Reference
https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438
CVE Modified by Python Software Foundation
7/23/2026 3:16:53 PM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0b4","versionType":"python","status":"affected"}]}]
CVE Modified by Python Software Foundation
6/30/2026 12:16:43 PM
Action
Type
Old Value
New Value
Added
Reference
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
Added
Reference
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
Added
Reference
https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
Added
Reference
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
Added
Reference
https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
Added
Reference
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.16.0","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0","versionType":"python","status":"affected"}]}]
CVE Modified by CISA-ADP
6/24/2026 1:16:56 PM
Action
Type
Old Value
New Value
Added
SSVC
{"timestamp":"2026-06-24T15:33:49.665045Z","id":"CVE-2026-11972","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}
CVE Modified by Python Software Foundation
6/24/2026 11:16:39 AM
Action
Type
Old Value
New Value
Changed
Description
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
Removed
Reference
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
Removed
Reference
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
Removed
Reference
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
Removed
Reference
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.16.0","versionType":"python","status":"affected"}]}]
CVE Modified by Python Software Foundation
6/24/2026 9:16:31 AM
Action
Type
Old Value
New Value
Added
Reference
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
Added
Reference
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
Added
Reference
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
Added
Reference
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
Changed
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.16.0","versionType":"python","status":"affected"}]}]
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.15.0","versionType":"python","status":"affected"}]}]
New CVE Received from Python Software Foundation
6/23/2026 7:16:49 PM
Action
Type
Old Value
New Value
Added
Description
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.
Added
CVSS V4.0
AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Added
CWE
CWE-252
Added
CWE
CWE-606
Added
CWE
CWE-770
Added
Reference
https://github.com/python/cpython/issues/151981
Added
Reference
https://github.com/python/cpython/pull/151982
Added
Reference
https://mail.python.org/archives/list/[email protected] /thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
Added
Affected
[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["tarfile"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.16.0","versionType":"python","status":"affected"}]}]
Quick Info
CVE Dictionary Entry: CVE-2026-11972 NVD
Published Date: 06/23/2026 NVD
Last Modified: 08/05/2026
Source: Python Software Foundation
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
