CVE-2024-6232: Regular-expression DoS when parsing TarFile headers

Published Sep 3, 2024
·
Updated

Last updated 7 May 2025

Other sources

Python CPython is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw when parsing TarFile headers. By using specially crafted tar archives, a remote attacker could exploit this vulnerability to cause a denial of service.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

— IBM

Regular-expression DoS when parsing TarFile headers

— Microsoft

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

— NVD

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile. TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

— F5

Affected Software

41 affected componentsFixes available
IBM Concert Software<=1.0.0, 1.0.1, 1.0.2, 1.0.2.1, 1.0.3
Python Python<3.8.20
Python Python>=3.9.0<3.9.20
Python Python>=3.10.0<3.10.15
Python Python>=3.11.0<3.11.10
Python Python>=3.12.0<3.12.6
Python Python=3.13.0-alpha0
Python Python=3.13.0-alpha1
Python Python=3.13.0-alpha2
Python Python=3.13.0-alpha3
Python Python=3.13.0-alpha4
Python Python=3.13.0-alpha5
Python Python=3.13.0-alpha6
Python Python=3.13.0-beta1
Python Python=3.13.0-beta2
Python Python=3.13.0-beta3
Python Python=3.13.0-beta4
Python Python=3.13.0-rc1
F5 BIG-IQ Centralized Management>=8.2.0<=8.4.0
8.4.1
All of the following
azurelinux/python3<3.9.19-5
3.9.19-5
Microsoft CBL-Mariner=2.0
All of the following
azurelinux/tensorflow<2.16.1-7
2.16.1-7
Microsoft Azure Linux=3.0
All of the following
azurelinux/python3<3.12.3-4
3.12.3-4
Microsoft Azure Linux=3.0
alpine/python3<3.10.15-r0
3.10.15-r0
alpine/python3<3.11.10-r0
3.11.10-r0
alpine/python3<3.11.10-r0
3.11.10-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0
alpine/python3<3.12.6-r0
3.12.6-r0
debian/pypy3*
debian/pypy3<7.3.18+dfsg-1
7.3.18+dfsg-1
debian/pypy3<7.3.18+dfsg-1
7.3.18+dfsg-1
debian/python3.11<3.11.2-6+deb12u4
3.11.2-6+deb12u4
debian/python3.13<3.13.0~rc2-1
3.13.0~rc2-1
debian/pypy3<=7.3.11+dfsg-2+deb12u3
7.3.19+dfsg-28.0.1+dfsg-1
debian/python3.11
3.11.2-6+deb12u83.11.2-6+deb12u9
debian/python3.13
3.13.5-2+deb13u53.13.18-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 8.4.1
  2. Upgrade

    Upgrade azurelinux/python3 to a version that resolves this vulnerability.

    Fixed in 3.9.19-5
  3. Upgrade

    Upgrade azurelinux/tensorflow to a version that resolves this vulnerability.

    Fixed in 2.16.1-7
  4. Upgrade

    Upgrade azurelinux/python3 to a version that resolves this vulnerability.

    Fixed in 3.12.3-4
  5. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.10.15-r0
  6. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.11.10-r0
  7. Upgrade

    Upgrade alpine/python3 to a version that resolves this vulnerability.

    Fixed in 3.12.6-r0
  8. Upgrade

    Upgrade debian/pypy3 to a version that resolves this vulnerability.

    Fixed in 7.3.18+dfsg-1
  9. Upgrade

    Upgrade debian/python3.11 to a version that resolves this vulnerability.

    Fixed in 3.11.2-6+deb12u4
  10. Upgrade

    Upgrade debian/python3.13 to a version that resolves this vulnerability.

    Fixed in 3.13.0~rc2-1
  11. Upgrade

    Upgrade debian/pypy3 to a version that resolves this vulnerability.

    Fixed in 7.3.19+dfsg-2Fixed in 8.0.1+dfsg-1
  12. Upgrade

    Upgrade debian/python3.11 to a version that resolves this vulnerability.

    Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9
  13. Upgrade

    Upgrade debian/python3.13 to a version that resolves this vulnerability.

    Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1

Event History

Sep 3, 2024
CVE Published
via MITRE·12:29 PM
Data Sourced
via MITRE·12:29 PM
DescriptionWeakness
Data Sourced
via OSV·12:29 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·01:15 PM
Affected Software
Data Sourced
via Red Hat·01:20 PM
DescriptionSeverityAffected Software
Sep 26, 2024
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeaknessAffected Software
Oct 25, 2024
Advisory Published
via F5·06:13 PM
Data Sourced
via F5·06:13 PM
DescriptionSeverityWeaknessAffected Software
Feb 18, 2026
Exploit Published
via GitHub·09:26 AM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2024-6232?

CVE-2024-6232 has a moderate severity rating due to its potential for causing a denial of service.

2

How do I fix CVE-2024-6232?

To fix CVE-2024-6232, update affected Python versions to the latest patched releases listed in the vulnerability advisories.

3

Which software is affected by CVE-2024-6232?

CVE-2024-6232 affects several versions of Python and products from IBM and F5 listed in the vulnerability description.

4

How does CVE-2024-6232 impact Python users?

CVE-2024-6232 can lead to denial of service for applications that utilize vulnerable Python libraries to handle tar archives.

5

What type of attack does CVE-2024-6232 enable?

CVE-2024-6232 enables a regular expression denial of service (ReDoS) attack through specially crafted tar files.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203