---
id: CVE-2026-11972
title: >-
  When using the "tarfile" module with a file opened in "streaming mode"
  (mode="r|") the tarfile module did not properly handle EOF, making archive
  parsing take exponentially longer.
summary: >-
  When using the "tarfile" module with a file opened in "streaming mode"
  (mode="r|") the tarfile module did not properly handle EOF, making archive
  parsing take exponentially longer.
severity: medium
cwe:
  - CWE-252
  - CWE-606
  - CWE-770
  - CWE-835
published: '2026-06-23'
updated: '2026-08-06'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11972'
references:
  - url: >-
      https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/151981'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/151982'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
    label: cna@python.org
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11972.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-11972'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492050'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-11972'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11972'
  - url: 'https://access.redhat.com/errata/RHSA-2026:54534'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35807'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35813'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35812'
  - url: 'https://access.redhat.com/errata/RHSA-2026:54554'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35806'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00715
epssPercentile: 0.53549
ingestedAt: '2026-08-06T20:03:56.259Z'
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - exploit_intelligence
  - ai_inference_server
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
  - openshift_dev_spaces
  - openshift_virtualization 4
  - self_service_automation_portal 2
  - hardened_images
patched:
  - hardened_images
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: vendor
---

## Overview

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:54534** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54534)
- **RHSA-2026:35807** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:35807)
- **RHSA-2026:35813** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:35813)
- **RHSA-2026:35812** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:35812)
- **RHSA-2026:54554** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54554)
- **RHSA-2026:35806** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:35806)
- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · no fix planned: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11972.json)