SecuriTricks - CVE-2025-8194

Description

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

Product(s) Impacted

Vendor	Product	Versions
Python	Cpython	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	python	cpython	/	/	/	/	/	/	/	/

References

https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38

https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe

https://github.com/python/cpython/issues/130577

https://github.com/python/cpython/pull/137027

https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/

CVSS Score

7.5 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: July 28, 2025, 7:15 p.m.
Last Modified: July 29, 2025, 2:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@python.org

CVE-2025-8194