CVE-2025-8194CWE-835

CVE-2025-8194

High · published July 28, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives.

This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00708 · 52.9th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2025-07-28T23:15Z
References (13)
https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 · [email protected]https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2 · [email protected]https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38 · [email protected]https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19 · [email protected]https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb · [email protected]https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f · [email protected]https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe · [email protected]https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227 · [email protected]https://github.com/python/cpython/issues/130577 · [email protected]https://github.com/python/cpython/pull/137027 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/ · [email protected]http://www.openwall.com/lists/oss-security/2025/07/28/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/07/28/2 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 JUL 18:42Z
    Tarfile infinite loop during parsing with negative member offset
    cvelistv5