CVE-2025-8194: Tarfile infinite loop during parsing with negative member offset
Tarfile infinite loop during parsing with negative member offset
Other sources
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.
This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:
import tarfile
def blockpatched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return blockpatched.origblock(self, count)
blockpatched.origblock = tarfile.TarInfo.block tarfile.TarInfo.block = blockpatched
— Red Hat
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.
This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate CVE-2025-8194 by patching CPython tarfile after importing tarfile: set tarfile.TarInfo._block = _block_patched (where _block_patched calls the original tarfile.TarInfo._block only when count < 0, otherwise returns tarfile.InvalidHeaderError('invalid offset')).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8194?
CVE-2025-8194 has been classified as a high-severity vulnerability due to the potential for infinite loops and deadlocks.
How does CVE-2025-8194 affect the CPython tarfile module?
CVE-2025-8194 affects the CPython tarfile module by allowing maliciously crafted tar archives to cause processing issues without initial errors.
What are the potential consequences of CVE-2025-8194?
The potential consequences of CVE-2025-8194 include application crashes and service denial due to infinite loops and deadlocks.
How can I mitigate CVE-2025-8194 in my applications?
To mitigate CVE-2025-8194, avoid using the affected APIs with untrusted tar archive inputs until a fix is applied.
When will a fix be available for CVE-2025-8194?
The timeline for a fix for CVE-2025-8194 will be communicated through the official Python Software Foundation channels.