CVE-2026-9669

A flaw was found in Python's bz2.BZ2Decompressor component. An attacker could provide specially crafted input that, when processed by an application reusing a decompressor object after an error, could lead to out-of-bounds writes in memory. This memory corruption could cause the application to crash, resulting in a Denial of Service (DoS).

This Moderate-impact flaw in Python's bz2.BZ2Decompressor component affects Red Hat Enterprise Linux 8. It allows an attacker to trigger a denial of service by providing specially crafted compressed data. Exploitation requires an application to reuse a BZ2Decompressor object after a decompression error, leading to out-of-bounds writes and a crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications processing untrusted BZ2 compressed data should avoid reusing bz2.BZ2Decompressor objects after a decompression error. Instead, a new bz2.BZ2Decompressor instance should be created for each new decompression attempt or after an error occurs. This prevents the decompressor from resuming from an invalid internal state.