CVE-2025-8194
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Tarfile infinite loop during parsing with negative member offset
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
CPython
- Vendor
- Python Software Foundation
- Product
- CPython
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | python | 3.9.24 | Unavailable | None listed |
| 3.10.0 | affected | python | 3.10.19 | Unavailable | None listed |
| 3.11.0 | affected | python | 3.11.14 | Unavailable | None listed |
| 3.12.0 | affected | python | 3.12.12 | Unavailable | None listed |
| 3.13.0 | affected | python | 3.13.6 | Unavailable | None listed |
| 3.14.0a1 | affected | python | 3.14.0rc2 | Unavailable | None listed |