CVE-2026-11972

A flaw was found in the Python tarfile module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the tarfile module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives.

A flaw was found in the Python tarfile module. When processing a tar archive in streaming mode (mode='r|'), the _Stream.seek function does not properly check for end-of-file, which can cause an infinite loop when processing a specially crafted archive. Red Hat ships Python as part of many products, and applications using tarfile's streaming mode are potentially affected by this denial of service vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using tarfile streaming mode (mode='r|') with untrusted tar archives. Use the standard file-based mode (mode='r') instead where possible.