CVE-2026-55206 HIGH

CVE-2026-55206: py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

Vendor Miurahr
Product py7zr
Weakness CWE-407
Published July 8, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.

Key dates

02Disclosure timeline

July 8, 2026 CVE published
July 9, 2026 Record updated