CVE-2024-8088: Infinite loop when iterating over zip archive entry names from zipfile.Path
Last updated 11 March 2025
Other sources
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.
When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
— NVD
There is a HIGH severity vulnerability affecting the CPython "zipfile" module.
When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
— Red Hat
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.10.14-r2 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.11.8-r1 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.11.9-r1 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.12.3-r2 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.12.5-r1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.19+dfsg-2Fixed in 8.0.1+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.18+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.0~rc2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8088?
CVE-2024-8088 is classified as a HIGH severity vulnerability affecting the CPython zipfile module.
How do I fix CVE-2024-8088?
To fix CVE-2024-8088, update to the latest versions of the affected CPython packages listed in the vulnerability report.
Which versions of CPython are affected by CVE-2024-8088?
CVE-2024-8088 affects specific versions of Python 2.7 and several versions of Python 3.9, 3.11, 3.12, and 3.13.
Is the zipfile.ZipFile class affected by CVE-2024-8088?
No, the more commonly used zipfile.ZipFile class is not affected by CVE-2024-8088.
What should I do if I am using an affected version of CPython with CVE-2024-8088?
If using an affected version of CPython with CVE-2024-8088, it's crucial to upgrade to a non-vulnerable version promptly.