CVE-2026-11972 HIGH

CVE-2026-11972: tarfile opened in streaming mode mishandles EOF

Vendor Python Software Foundation

Product CPython

Weakness CWE-252

Published June 23, 2026

Last update June 30, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

Key dates

02Disclosure timeline

June 23, 2026 CVE published

June 30, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-11972 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/252.html

Related vulnerabilities

CVE-2026-11972: tarfile opened in streaming mode mishandles EOF

01Description

02Disclosure timeline

03References

04Related CVE