CVE-2026-55195

Name of the Vulnerable Software and Affected Versions py7zr versions prior to 0.22.1

Description The Worker.decompress() function in py7zr/worker.py extracts archive entries without tracking the total decompressed size. This allows a specially crafted .7z file to cause disk or memory exhaustion before extraction completes, a scenario often referred to as a decompression bomb. The issue occurs because decompressed data is written directly to disk without a running total or a configurable size limit.

Recommendations Update to a version where the Worker.decompress() function tracks cumulative decompressed bytes and implements a size limit to prevent resource exhaustion.