← Vulnerability feed

Vulnerability record · CVE-2024-6232 · published 3 September 2024

CVE-2024-6232: Python inefficient regular expression (redos) vulnerability

Python · Python

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

7.5 CVSS 3.1 High EPSS 2.2% · top 17.2% CWE-1333 · Inefficient regular expression (ReDoS)
7.5CVSS 3.1 base score
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
13References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4 Patch
https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 Patch
https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 Patch
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d Patch
https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877 Patch
https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf Patch
https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 Patch
https://github.com/python/cpython/issues/121285 ExploitIssue TrackingPatch
https://github.com/python/cpython/pull/121286 Issue TrackingPatch
https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/ Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/09/03/5 Mailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
https://security.netapp.com/advisory/ntap-20241018-0007/ Third Party Advisory

Track CVE-2024-6232 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-5031Python vulnerabilityMultiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer va…EPSS 3.0%9.8CVE-2022-48565Python xml external entity (xxe) vulnerabilityAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist fil…EPSS 5.2%9.8CVE-2022-37454Extended keccak code package project extended keccak code package integer overflow vulnerabilityThe Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute …EPSS 7.4%9.8CVE-2021-29921Python vulnerabilityIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) all…EPSS 6.8%9.8CVE-2021-3177Python classic buffer overflow vulnerabilityPython 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic…EPSS 24%9.8CVE-2020-27619Python vulnerabilityIn Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.EPSS 8.3%9.8CVE-2020-15801Python untrusted search path vulnerabilityIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <execu…EPSS 3.6%9.8CVE-2014-4650Python path traversal vulnerabilityThe CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remo…EPSS 24%

Source: NIST National Vulnerability Database (record CVE-2024-6232), CISA KEV, FIRST EPSS (scores of 2026-11-13). This page is refreshed as NVD updates the record.