Memory Exhaustion Vulnerability in py7zr Library by miurahr

CVE-2026-55195

What is CVE-2026-55195?

The py7zr library, utilized for handling 7zip archives in Python, contains a significant flaw in its Worker.decompress() method. This vulnerability allows an attacker to craft a .7z file that, upon extraction, can expand drastically in size—leading to potential denial-of-service conditions by exhausting system memory or disk space. With the ability to create a 15.6 KB file that can inflate to 100 MB or more, the risk is particularly acute for systems without stringent resource monitoring. This issue was resolved in the library's version 1.1.3, emphasizing the importance of updating to mitigate these risks.

References