CVE-2026-9669 Overview
CVE-2026-9669 is a stack-based out-of-bounds write vulnerability in the Python bz2 module. The flaw affects bz2.BZ2Decompressor objects, which could be reused after a decompression error. When an application catches the resulting OSError and retries decompression with the same object, crafted input can resume from an invalid internal state and write past the bounds of a stack buffer. The vulnerability is tracked under CWE-121: Stack-based Buffer Overflow and was addressed across multiple CPython commits.
Critical Impact
Processing untrusted bzip2 data through a reused BZ2Decompressor instance can crash the Python process, enabling denial-of-service against any service that accepts attacker-controlled compressed input.
Affected Products
- CPython bz2 module (BZ2Decompressor class)
- Python applications that catch OSError from decompression and retry with the same decompressor instance
- Downstream distributions and runtimes embedding vulnerable CPython builds
Discovery Timeline
- 2026-06-08 - CVE CVE-2026-9669 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-9669
Vulnerability Analysis
The vulnerability stems from improper state handling in BZ2Decompressor after a decompression failure. The decompressor normally signals corrupt input by raising OSError. The internal C-level state is left in a position that is no longer valid for continued use, but the object is not marked as terminated. An application that catches the exception and feeds additional data into the same instance causes the underlying decompression routine to resume from this invalid state. The routine then performs writes against a fixed-size stack buffer using offsets derived from the corrupted state, producing an out-of-bounds write.
Root Cause
The root cause is missing invalidation of the decompressor object after an error path. CPython did not prevent reuse of a BZ2Decompressor once an error condition had been signaled. Combined with internal bookkeeping that assumed a consistent state, this allowed write offsets to exceed the allocated stack buffer. The fix is distributed across CPython commits 157a5df8, 5755d0f0, 619a12b2, and d3ca2698.
Attack Vector
Exploitation requires an application that (1) accepts attacker-supplied bzip2 data, (2) catches OSError raised by BZ2Decompressor.decompress(), and (3) continues to invoke the same decompressor with additional input. The attacker delivers a crafted bzip2 stream that triggers the initial decompression error followed by data that drives the corrupted resume path. Network-reachable services that decompress user-supplied archives, log streams, or API payloads represent the primary exposure. See the Python Security Announcement and GitHub Issue 150599 for further technical context.
No verified public exploit code is available at the time of writing. Refer to the GitHub Pull Request 150600 for the canonical fix discussion.
Detection Methods for CVE-2026-9669
Indicators of Compromise
- Unexpected segmentation faults or SIGSEGV crashes in Python processes that perform bzip2 decompression
- Repeated OSError exceptions from bz2 decompression immediately preceding process termination
- Crash dumps showing corrupted stack frames inside the CPython _bz2 extension module
Detection Strategies
- Inspect application code paths that import bz2 and identify any try/except OSError blocks that continue using the same BZ2Decompressor instance after failure
- Audit dependencies for libraries that wrap bz2 decompression and reuse decompressor objects across calls
- Correlate process crash telemetry with inbound traffic containing application/x-bzip2 payloads or .bz2 files
Monitoring Recommendations
- Enable core-dump collection on Python services that accept compressed user input and alert on new crash signatures in _bz2*.so
- Monitor for unusual rates of decompression-related exceptions in application logs that may indicate fuzzing or probing
- Track CPython runtime versions across the fleet and flag hosts running unpatched interpreters
How to Mitigate CVE-2026-9669
Immediate Actions Required
- Upgrade CPython to a version that includes the fixes referenced in the Python Security Announcement
- Audit application code and discard any BZ2Decompressor instance after it raises OSError rather than retrying with the same object
- Validate and size-limit untrusted bzip2 input before passing it to the decompressor
Patch Information
The vulnerability is resolved in CPython through commits 157a5df8, 5755d0f0, 619a12b2, and d3ca2698. Apply the corresponding interpreter updates from your distribution. Consult the OpenWall OSS-Security advisory for downstream packager guidance.
Workarounds
- Wrap decompression in a helper that instantiates a fresh BZ2Decompressor on every OSError and releases the failed object
- Reject decompression input that exceeds expected size or fails preliminary header validation
- Isolate decompression workloads in short-lived worker processes so a crash does not affect the parent service
# Verify the installed CPython version and rebuild containers using a patched interpreter
python3 -c "import sys; print(sys.version)"
pip index versions cpython # confirm patched build is available before redeploying
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
