Skip to content
VulniPulse
Sign in
Advisory severityMedium6.5Red Hat Linux

Medium [CVE-2026-11972] Python tarfile module: Denial of Service via improper EOF handling in streaming mode

This medium-severity Red Hat Linux advisory covers CVE-2026-11972 affecting Red Hat Hardened Images, Exploit Intelligence, Red Hat AI Inference Server.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-11972 Source published Source updated

VulniPulse record published Record updated

CVE-2026-11972
Affected products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. This can cause the `tarfile` module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives.

When processing a tar archive in streaming mode (mode='r|'), the _Stream.seek function does not properly check for end-of-file, which can cause an infinite loop when processing a specially crafted archive.

Red Hat ships Python as part of many products, and applications using tarfile's streaming mode are potentially affected by this denial of service vulnerability. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

Weakness: CWE-835.

Affected Red Hat products: Red Hat Hardened Images; Exploit Intelligence; Red Hat AI Inference Server; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; Self-service automation portal 2.

Red Hat fixing advisory: RHSA-2026:35806, RHSA-2026:35807, RHSA-2026:35812, RHSA-2026:35813, RHSA-2026:54534, RHSA-2026:54554.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Fixed versions
  • python3-14-main-3.14.6-1.2.hum1
  • python3-11-main-3.11.15-4.4.hum1
  • python3-13-main-3.13.14-1.2.hum1
  • python3-12-main-3.12.13-3.3.hum1
  • python3-14-main-3.14.7-1.hum1
  • python3-13-main-3.13.15-1.hum1
  • RHSA-2026:35806
  • RHSA-2026:35807
  • RHSA-2026:35812
  • RHSA-2026:35813
  • RHSA-2026:54534
  • RHSA-2026:54554

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Avoid using tarfile streaming mode (mode='r|') with untrusted tar archives. Use the standard file-based mode (mode='r') instead where possible.

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.