CVE-2026-6100: Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Last updated 6 July 2026
Other sources
Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
— Launchpad
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u2Fixed in 7.3.5+dfsg-2+deb11u5Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2Fixed in 7.3.23+dfsg-1 - Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.5-2+deb13u2Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6100?
CVE-2026-6100 has a moderate severity rating due to the potential for use-after-free vulnerabilities leading to arbitrary code execution.
How do I fix CVE-2026-6100?
To fix CVE-2026-6100, update to the latest version of Python CPython that addresses the use-after-free vulnerability.
Which versions of Python CPython are affected by CVE-2026-6100?
CVE-2026-6100 affects specific versions of Python CPython where the decompression modules are utilized.
What systems are at risk from CVE-2026-6100?
Systems utilizing affected versions of Python CPython for decompression tasks under memory pressure are at risk from CVE-2026-6100.
Can CVE-2026-6100 lead to data breaches?
Yes, CVE-2026-6100 can potentially allow attackers to exploit the vulnerability, leading to data breaches or unauthorized access.