High severity · published Jul 28, 2025
CVE-2025-8194
Tarfile infinite loop during parsing with negative member offset
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.
This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.9.24; 3.10.0 before 3.10.19; 3.11.0 before 3.11.14; 3.12.0 before 3.12.12; 3.13.0 before 3.13.6; 3.14.0a1 before 3.14.0rc2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8194
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8194
gist.github.com
https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
github.com
https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2
github.com
https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38
github.com
https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19
github.com
https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb
github.com
https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.4
CVE-2025-4517
Arbitrary writes via tarfile realpath overflow
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.7
CVE-2024-8088
Infinite loop when iterating over zip archive entry names from zipfile.Path