Tarfile infinite loop during parsing with negative member offset
Summary
| CVE | CVE-2025-8194 |
|---|---|
| State | PUBLISHED |
| Assigner | PSF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-07-28 19:15:43 UTC |
| Updated | 2026-07-31 14:16:45 UTC |
| Description | There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.006110000 probability, percentile 0.458730000 (date 2026-08-03)
Problem Types: CWE-835 | CWE-835 CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Python Software Foundation | CPython | affected 3.9.24 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.10.0 3.10.19 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.11.0 3.11.14 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.12.0 3.12.12 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.13.0 3.13.6 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.14.0a1 3.14.0rc2 python | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/python/cpython/pull/137027 | [email protected] | github.com | |
| github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2 | [email protected] | github.com | |
| www.openwall.com/lists/oss-security/2025/07/28/1 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| www.openwall.com/lists/oss-security/2025/07/28/2 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f | [email protected] | github.com | |
| gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 | [email protected] | gist.github.com | |
| github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38 | [email protected] | github.com | |
| github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb | [email protected] | github.com | |
| mail.python.org/archives/list/[email protected]/thread/ZULLF3IZ726... | [email protected] | mail.python.org | |
| github.com/python/cpython/issues/130577 | [email protected] | github.com | |
| github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227 | [email protected] | github.com | |
| github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe | [email protected] | github.com | |
| github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Alexander Urieles (en)
CNA: Seth Larson (en)
CNA: Ethan Furman (en)
CNA: Steve Dower (en)
There are currently no legacy QID mappings associated with this CVE.