PSF-2026-31: tarfile opened in streaming mode mishandles EOF

Published Jun 23, 2026

Updated

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

Affected Software

1 affected component

Python Software Foundation tarfile

Event History

Jun 23, 2026

CVE Published

via OSV·10:02 PM

Data Sourced

via OSV·10:02 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments that use Python's tarfile module to parse archives opened in streaming mode with mode="r|" are affected by the described condition. The provided information does not identify impacts for other tarfile modes.

How can I determine whether my application uses the affected path?

Review code and dependencies that open archives through tarfile and check for mode="r|". That streaming-mode usage is the condition identified in the vulnerability information.

PSF-2026-31: tarfile opened in streaming mode mishandles EOF

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

How can I determine whether my application uses the affected path?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

How can I determine whether my application uses the affected path?