Vulnerability record · CVE-2026-11972 · published 23 June 2026

CVE-2026-11972: Unchecked return value vulnerability

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

8.2 CVSS 4.0 High EPSS 0.72% · top 48.1% CWE-252 · Unchecked return valueCWE-606 · CWE-606 Awaiting Analysis

8.2CVSS 4.0 base score

0.72%EPSS exploitation probability, 30 days

NoNot in CISA KEV

0Affected product versions listed by NVD

10References

13 Aug 2026Last modified by NVD

Description

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

Link	Tags
https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438
https://github.com/python/cpython/issues/151981
https://github.com/python/cpython/pull/151982
https://mail.python.org/archives/list/[email protected]/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/

Track CVE-2026-11972 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-11972), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.