PSF-2026-10: tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

Published Mar 12, 2026

Updated

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Affected Software

1 affected component

Python Software Foundation tarfile

Event History

Mar 12, 2026

CVE Published

via OSV·05:59 PM

Data Sourced

via OSV·05:59 PM

DescriptionSeverity

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to supply a crafted tar archive that uses GNU LONGNAME or LONGLINK multi-block handling. Exploitation also requires conditions reflected by the vector: local access, low privileges, high attack complexity, and an additional prerequisite.

Who is realistically exposed?

Systems that process untrusted or attacker-controlled tar archives with Python's tarfile module are the relevant exposure point. The documented impact is limited to integrity: the affected archive may be interpreted differently from other tar implementations.

How can I tell whether processing was affected?

Review tar archives accepted by the application for GNU LONGNAME or GNU LONGLINK entries and AREGTYPE (\x00) blocks within the relevant multi-block member processing. The provided data does not identify a version range or a direct detection method.

PSF-2026-10: tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is realistically exposed?

How can I tell whether processing was affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is realistically exposed?

How can I tell whether processing was affected?