Defect in CPython's TarFile Module Exposes Users to Infinite Loop Risks
CVE-2025-8194

7.5HIGH

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
28 July 2025

What is CVE-2025-8194?

The CPython 'tarfile' module contains a defect that affects the TarFile extraction and entry enumeration APIs. This flaw allows negative offsets to be processed without error, resulting in potential infinite loops and deadlocks when parsing specially crafted tar archives. It is crucial for users and developers working with the 'tarfile' module to apply the recommended patch to mitigate these risks effectively.

Affected Version(s)

CPython 0 <= 3.13.5

References

https://github.com/python/cpython/issues/130577
issue-tracking
https://github.com/python/cpython/pull/137027
patch
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexander Urieles
Seth Larson
Ethan Furman
Steve Dower
.
CVE-2025-8194 : Defect in CPython's TarFile Module Exposes Users to Infinite Loop Risks