CVE-2026-55206: py7zr Library DOS Vulnerability

CVE-2026-55206 Overview

CVE-2026-55206 is an algorithmic complexity vulnerability in py7zr, a Python library for 7zip archive compression, decompression, encryption, and decryption. The flaw resides in the PackInfo._read() function within archiveinfo.py. The function uses an O(n²) cumulative sum pattern over an attacker-controlled numstreams value parsed from archive headers. A crafted .7z archive can trigger excessive CPU consumption during SevenZipFile.__init__(), before any extraction takes place. The issue is fixed in version 1.1.3 and is tracked under [CWE-407] (Inefficient Algorithmic Complexity).

Critical Impact
A remote attacker can supply a malicious .7z archive that causes sustained CPU exhaustion in any application invoking py7zr on untrusted input, leading to denial of service.

Affected Products

py7zr versions prior to 1.1.3
Python applications and services that parse untrusted .7z archives with py7zr
Downstream tools embedding py7zr for archive inspection or extraction workflows

Discovery Timeline

2026-07-08 - CVE-2026-55206 published to NVD
2026-07-08 - Last updated in NVD database
Fix released - py7zrv1.1.3 contains the patch

Technical Details for CVE-2026-55206

Vulnerability Analysis

The vulnerability is an algorithmic complexity denial of service. PackInfo._read() in py7zr/archiveinfo.py computes cumulative pack positions using a pattern whose runtime scales quadratically with numstreams. Because numstreams is read directly from the archive header without an upper bound, an attacker controls the size of the input driving the loop. Parsing occurs during SevenZipFile.__init__(), so the CPU spike happens on object construction rather than during extraction. Any code path that opens an attacker-supplied .7z file is exposed, including archive listing, metadata inspection, and antivirus or content-scanning pipelines.

Root Cause

The root cause is two-fold: absent validation of the numstreams field parsed from archive headers, and use of an O(n²) cumulative sum construction to build packpositions. A modest header value can therefore expand into billions of operations. The upstream fix enforces validation on numstreams and rewrites the position computation using itertools.accumulate, reducing the loop to O(n).

Attack Vector

Exploitation requires no authentication and no user interaction beyond delivering the crafted archive to a vulnerable parser. Any network-reachable service that ingests user-supplied .7z files, such as upload endpoints, email gateways, or automated scanners, can be targeted remotely.

python

 from binascii import unhexlify
 from functools import reduce
 from io import BytesIO
+from itertools import accumulate
 from operator import and_, or_
 from struct import pack, unpack
 from typing import Any, BinaryIO, Optional, Union

Source: GitHub commit d7aa3a1. The patch introduces itertools.accumulate and enforces numstreams validation, replacing the quadratic cumulative-sum pattern with a linear computation.

Detection Methods for CVE-2026-55206

Indicators of Compromise

Sustained single-core CPU saturation in Python processes calling py7zr.SevenZipFile() on user-supplied archives.
Long-running or hung workers in archive processing services with no progress in extraction logs.
.7z uploads whose PackInfo header declares an unusually large numstreams value relative to file size.

Detection Strategies

Inventory Python environments for py7zr installations below version 1.1.3 using pip list or SBOM tooling.
Instrument archive-handling services to log per-file parse duration and flag SevenZipFile.__init__() calls exceeding a defined threshold.
Add static pre-checks that parse the .7z header and reject archives whose declared numstreams exceeds a sane bound before handing the file to py7zr.

Monitoring Recommendations

Track CPU utilization and wall-clock time of archive parsing workers and alert on anomalous spikes tied to specific file hashes.
Correlate upload telemetry with backend worker exhaustion events to identify malicious submitters.
Enable dependency scanning in CI to fail builds that pin py7zr below 1.1.3.

How to Mitigate CVE-2026-55206

Immediate Actions Required

Upgrade py7zr to version 1.1.3 or later across all applications, containers, and build artifacts.
Audit services that accept .7z uploads and place CPU and wall-clock limits on parsing workers.
Quarantine and hash-block any archive samples observed causing parser hangs pending analysis.

Patch Information

The fix is delivered in py7zr v1.1.3. Technical details are documented in the GHSA-h4gh-22qq-72r7 advisory and the remediation commit, which enforces numstreams validation and replaces the quadratic accumulator with itertools.accumulate.

Workarounds

Reject .7z files above a strict size ceiling before passing them to py7zr.
Run archive parsing in an isolated subprocess with ulimit-enforced CPU time and memory caps so a hostile archive cannot exhaust the parent service.
Validate archive headers with a lightweight pre-parser and drop files declaring implausible numstreams values.

bash

# Upgrade py7zr to the patched release
pip install --upgrade 'py7zr>=1.1.3'

# Verify installed version
python -c "import py7zr; print(py7zr.__version__)"

# Sandbox archive parsing with CPU and memory limits (Linux)
ulimit -t 10 -v 524288 && python parse_archive.py suspect.7z