{"id":"CVE-2026-11972","title":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.","summary":"When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.","severity":"none","cwe":["CWE-252","CWE-606","CWE-770"],"published":"2026-06-23","updated":"2026-08-06","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11972","references":[{"url":"https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896","label":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438","label":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/151981","label":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/151982","label":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/","label":"cna@python.org"}],"tags":["nvd"],"epss":0.00445,"epssPercentile":0.37955,"ingestedAt":"2026-08-06T20:03:56.259Z","slug":"CVE-2026-11972","body":"## Overview\n\nWhen using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}