This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-11972 →

DEBIAN-CVE-2026-11972

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive pars...

Original description

The description as published by the source.

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 pypy3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0+dfsg-1"}]}]

Debian:12 python3.11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python3.13

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.5-2+deb13u5"}]}]

Debian:14 python3.13

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.15-1"}]}]

Debian:14 python3.14

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-1"}]}]

References

advisory security-tracker.debian.org