vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-11972

tarfile opened in streaming mode mishandles EOF

HIGH
8.2
CVSS Score
Published: June 23, 2026 at 10:02 PM UTC
Updated: October 25, 2026 at 11:10 PM UTC
1 product affected across 1 vendorPython

Using CPython by Python Software Foundation?

Get instant alerts when new vulnerabilities affect CPython - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.2
Exploit prediction
EPSS 0.7%
SSVC
No known exploit

Description

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Python· Python
90%
v < 3.10.213.11.0 ≤ v < 3.11.163.12.0 ≤ v < 3.12.143.13.0 ≤ v < 3.13.153.14.0 ≤ v < 3.14.73.15.0a1 ≤ v < 3.15.0b43.11.03.12.03.13.03.14.03.15.0a1
Affected range stops below 3.10.21, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.11.16, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.12.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.13.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.14.7, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.15.0b4, so it looks safe — our inference, not a vendor statement

References (10)

Issue Tracking
Source: cverecord
https://github.com/python/cpython/issues/151981
Patch
Source: cverecord
https://github.com/python/cpython/pull/151982
Vendor Advisory
Source: cverecord
https://mail.python.org/archives/list/[email protected]/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
Patch
Source: cverecord
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
Patch
Source: cverecord
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
Patch
Source: cverecord
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
Patch
Source: cverecord
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
Patch
Source: cverecord
https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.2HIGHPSF
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-252CWE-606CWE-770

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card