CVE-2024-6232: Regular-expression DoS when parsing TarFile headers
Last updated 7 May 2025
Other sources
Python CPython is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw when parsing TarFile headers. By using specially crafted tar archives, a remote attacker could exploit this vulnerability to cause a denial of service.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
— IBM
There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
— MITRE
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile. TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
— F5
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6232?
CVE-2024-6232 has a moderate severity rating due to its potential for causing a denial of service.
How do I fix CVE-2024-6232?
To fix CVE-2024-6232, update affected Python versions to the latest patched releases listed in the vulnerability advisories.
Which software is affected by CVE-2024-6232?
CVE-2024-6232 affects several versions of Python and products from IBM and F5 listed in the vulnerability description.
How does CVE-2024-6232 impact Python users?
CVE-2024-6232 can lead to denial of service for applications that utilize vulnerable Python libraries to handle tar archives.
What type of attack does CVE-2024-6232 enable?
CVE-2024-6232 enables a regular expression denial of service (ReDoS) attack through specially crafted tar files.