PT-2025-31145 · Python+9 · Cpython+10
Alexander Urieles
+3
·
Published
2025-07-28
·
Updated
2026-04-29
·
CVE-2025-8194
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
CPython versions (affected versions not specified)
Description
A defect exists in the CPython “tarfile” module, impacting the “TarFile” extraction and entry enumeration APIs. The tar implementation processes tar archives with negative offsets without error, leading to an infinite loop and deadlock when parsing maliciously crafted tar archives.
Recommendations
Include the following patch after importing the “tarfile” module:
import tarfile
def block patched(self, count):
if count < 0: # pragma: no cover
raise tarfile.InvalidHeaderError("invalid offset")
return block patched. orig block(self, count)
block patched. orig block = tarfile.TarInfo. block
tarfile.TarInfo. block = block patchedFix
DoS
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Cpython
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Tarfile