CVE-2026-11972: tarfile opened in streaming mode mishandles EOF
tarfile opened in streaming mode mishandles EOF
Other sources
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11972?
CVE-2026-11972 has a severity rating of 8.2, classified as high.
How do I fix CVE-2026-11972?
To mitigate CVE-2026-11972, avoid using the tarfile module in streaming mode or upgrade to the patched version of Python.
What does CVE-2026-11972 affect?
CVE-2026-11972 affects the Python tarfile module when files are opened in 'streaming mode'.
What issue does CVE-2026-11972 cause?
CVE-2026-11972 can cause significant delays in archive parsing due to improper handling of EOF.
When was CVE-2026-11972 published?
CVE-2026-11972 was published on June 23, 2026.