BIT-libpython-2026-11972: tarfile opened in streaming mode mishandles EOF

Published Jun 23, 2026

Updated

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

Affected Software

1 affected component

Python Software Foundation Python tarfile module

Event History

Jun 23, 2026

CVE Published

via OSV·10:02 PM

Data Sourced

via OSV·10:02 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments are exposed if they use Python's tarfile module to parse archives opened in streaming mode with mode="r|". The reported impact is availability only.

What does exploitation require?

The vector is network-accessible and requires no privileges or user interaction. The severity vector indicates that additional attack requirements are present, but the provided data does not specify them.

Is a default configuration known to be affected?

The provided data does not state whether streaming mode is used by default. Exposure depends on whether the application explicitly opens tar archives using mode="r|".

BIT-libpython-2026-11972: tarfile opened in streaming mode mishandles EOF

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does exploitation require?

Is a default configuration known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does exploitation require?

Is a default configuration known to be affected?