CVE-2025-8194High· 7.5▾ TwilightThere is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and dea…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
0.6% → 0.8%
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.
This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-47273High· 7.1setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)
CVE-2026-59874High· 7.5tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
CVE-2026-101607Medium· 4.9mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101607)
CVE-2026-101755Medium· 5.3mysql: mysql: Denial of Service via client programs (CVE-2026-101755)
CVE-2026-101776Medium· 4.9mysql: mysql: Denial of Service in Group Replication plugin (CVE-2026-101776)
CVE-2026-101787Medium· 4.9mysql: mysql: Denial of Service via Server Optimizer flaw (CVE-2026-101787)