CVE-2026-11972: Python Tarfile Module DoS Vulnerability

CVE-2026-11972 Overview

CVE-2026-11972 is a denial-of-service vulnerability in the Python standard library tarfile module. When a tar archive is opened in streaming mode using mode="r|", the module fails to properly handle end-of-file (EOF) conditions. This improper handling causes archive parsing time to grow exponentially. Attackers can supply crafted or truncated tar archives to applications that process untrusted archives in streaming mode. The flaw is tracked under CWE-252: Unchecked Return Value and affects CPython. The issue was disclosed through the upstream Python Security Announcement.

Critical Impact
Remote attackers can trigger sustained CPU exhaustion in Python applications that parse untrusted tar archives in streaming mode, resulting in denial of service.

Affected Products

CPython tarfile module (streaming mode mode="r|")
Python applications and services that process untrusted tar archives in streaming mode
Downstream tooling that wraps the standard library tarfile API for archive ingestion

Discovery Timeline

2026-06-23 - CVE-2026-11972 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-11972

Vulnerability Analysis

The vulnerability resides in the Python tarfile module when archives are opened in streaming mode with mode="r|". Streaming mode is used when the underlying file object does not support seek(), such as pipes, sockets, or HTTP response streams. In this mode the parser must rely on read operations returning empty data to detect EOF.

The parser does not correctly check the result of read operations against EOF conditions. As a result, the module repeatedly re-attempts header parsing on truncated or malformed input. Each retry compounds work already performed, producing parsing time that grows exponentially relative to archive size. The flaw maps to CWE-252: Unchecked Return Value.

Root Cause

The root cause is missing or incorrect EOF detection logic in the streaming-mode code path of tarfile. When the underlying stream returns less data than requested or signals end-of-stream, the module does not terminate the parse loop cleanly. Instead it continues attempting to read and decode tar headers, multiplying the work performed for each successive iteration.

Attack Vector

An attacker delivers a crafted tar archive over the network to any service that opens it with tarfile.open(fileobj=stream, mode="r|") or equivalent. No authentication and no user interaction are required. The crafted archive does not need to be large — its structure alone is sufficient to force exponential parsing behavior, exhausting CPU resources on the host. Confidentiality and integrity are not affected; availability impact is high.

No public proof-of-concept code has been released. Technical details of the corrected logic are tracked in the upstream GitHub Issue Discussion and the associated GitHub Pull Request.

Detection Methods for CVE-2026-11972

Indicators of Compromise

Python processes exhibiting sustained high CPU usage while reading from a network stream or pipe.
Long-running threads with stack frames inside tarfile.TarFile.next or tarfile._Stream methods.
Truncated or malformed tar archives received from external sources prior to a service hang.

Detection Strategies

Audit application code for calls to tarfile.open with a streaming mode string ("r|", "r|gz", "r|bz2", "r|xz") that operate on untrusted input.
Profile Python services that ingest archives and alert when parsing time exceeds an expected threshold per megabyte of input.
Inspect process telemetry for Python workers blocked in tarfile call stacks while consuming a single CPU core at 100%.

Monitoring Recommendations

Track CPU utilization and request latency on services that accept tar archives from external clients.
Log archive size, source IP, and parse duration for every archive processed in streaming mode.
Enable timeouts on archive-handling endpoints and alert when timeouts are reached for inputs from a single source.

How to Mitigate CVE-2026-11972

Immediate Actions Required

Identify all Python services using tarfile in streaming mode against untrusted input and apply the upstream Python patch as soon as it is available in your distribution.
Enforce strict size and time limits on archive parsing operations to bound CPU consumption per request.
Where feasible, switch to non-streaming mode (mode="r") after first writing the archive to a bounded-size temporary file.

Patch Information

The upstream fix is tracked in the CPython GitHub Pull Request 151982 and discussed in CPython Issue 151981. Coordinated disclosure details are published in the Python Security Announcement. Apply the corresponding Python interpreter update from your operating system or runtime vendor once released, and rebuild any container images that bundle Python.

Workarounds

Reject tar archives at an upload boundary that exceed expected size or fail a structural validation pre-check.
Wrap tarfile parsing in a subprocess or worker with an enforced CPU time limit using resource.setrlimit(resource.RLIMIT_CPU, ...).
Avoid mode="r|" for untrusted streams; buffer the archive to disk first, then open it in seekable mode.

bash

# Configuration example: enforce a CPU time limit on archive workers
import resource, tarfile

# Limit each worker to 10 seconds of CPU time before SIGXCPU is delivered
resource.setrlimit(resource.RLIMIT_CPU, (10, 10))

# Prefer seekable, non-streaming mode for untrusted input
with open("/tmp/upload.tar", "rb") as f:
    with tarfile.open(fileobj=f, mode="r") as tar:
        for member in tar:
            ...  # validate member before extraction