https://seclists.org/oss-sec/2025/q3/64: Fwd:[CVE-2025-8194] Cpython Tarfile infinite loop during parsing with negative member offset
Published Jul 29, 2025
·Updated
Affected Software
1 affected component
Python Software Foundation CPython>=0, <3.14.0
Frequently Asked Questions
1
What is the severity of CVE-2025-8194?
CVE-2025-8194 is considered a moderate severity vulnerability due to the potential for denial of service through an infinite loop.
2
How do I fix CVE-2025-8194?
To fix CVE-2025-8194, update your CPython installation to the latest patched version available on GitHub.
3
Which versions of Python are affected by CVE-2025-8194?
CVE-2025-8194 affects all versions of Python from 0 to 3.14.0.
4
What type of vulnerability is CVE-2025-8194?
CVE-2025-8194 is a denial of service vulnerability caused by an infinite loop during the parsing of tar files with negative member offsets.
5
Can CVE-2025-8194 be exploited remotely?
Yes, CVE-2025-8194 can potentially be exploited remotely if an attacker can supply a malicious tar file to the affected CPython version.