Memory Exhaustion Issue in Python During Zip File Decompression
CVE-2026-15310

2.1LOW

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
25 August 2026

What is CVE-2026-15310?

A vulnerability exists in certain versions of Python when decompressing maliciously crafted zip files that utilize bzip, LZMA, or Zstandard compression formats. An attacker can exploit this flaw to manipulate the pre-allocation of memory by controlling the size specified during the decompression process. This could potentially lead to memory exhaustion, impacting the stability of applications that utilize affected versions of CPython.

Affected Version(s)

CPython 0 < 3.16.0

References

https://github.com/python/cpython/pull/156003
patch
https://github.com/python/cpython/issues/156002
issue-tracking
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tonghuaroot (童话) (https://github.com/tonghuaroot)
Petr Viktorin (https://github.com/encukou)
William Woodruff (https://github.com/woodruffw)
.