PSF-2026-39: zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

Published Aug 25, 2026

Updated

When decompressing crafted zip files using the bzip/LZMA/Zstandard

compressions, Python could use an attacker-controlled size to

pre-allocate memory, possibly resulting in memory exhaustion.

Affected Software

1 affected component

Python Software Foundation Python

Event History

Aug 25, 2026

CVE Published

via OSV·03:07 PM

Data Sourced

via OSV·03:07 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger the issue?

An attacker must get a crafted ZIP file processed by Python. The affected archive members use bzip2, LZMA, or Zstandard compression and can specify a size that causes memory pre-allocation.

Are applications that read ZIP members in chunks protected by their chunk-size limits?

Not necessarily. For the affected compression methods, attacker-controlled pre-allocation can defeat memory limits expected from chunked reads, potentially leading to memory exhaustion.

PSF-2026-39: zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Are applications that read ZIP members in chunks protected by their chunk-size limits?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

Are applications that read ZIP members in chunks protected by their chunk-size limits?