CVE-2026-15310: zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
Published Aug 25, 2026
·Updated
When decompressing crafted zip files using the bzip/LZMA/Zstandard
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion.
Affected Software
1 affected component
Python Python
Event History
Aug 25, 2026
CVE Published
via MITRE·03:07 PM
Data Sourced
via MITRE·03:07 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What conditions are required for exploitation?
An application must decompress a crafted ZIP file containing members compressed with bzip2, LZMA, or Zstandard. The attacker-controlled size can cause Python to pre-allocate memory and potentially exhaust available memory.
2
Are applications protected by reading ZIP members in chunks?
Not reliably for ZIP members using bzip2, LZMA, or Zstandard compression. These decompression paths lack a max_length bound, so crafted member data can defeat chunked-read memory limits.
3
What is the likely operational impact?
The stated impact is memory exhaustion. Affected processes may consume excessive memory while decompressing a malicious ZIP file.