PT-2026-51098 · Pypi · Py7Zr
CVE-2026-55206
·
Published
2026-06-19
·
Updated
2026-07-13
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
py7zr versions prior to 1.1.3
Description
A denial of service issue exists where a crafted .7z archive with a large
numstreams value causes excessive CPU consumption. This occurs because the PackInfo. read() function in archiveinfo.py uses an O(n^2) cumulative sum pattern to calculate self.packpositions. Since numstreams is read directly from the archive header and is attacker-controlled, the SevenZipFile. init () function performs quadratic work during header parsing before any extraction takes place.Recommendations
Update to version 1.1.3 or newer.
As a temporary workaround, restrict the processing of .7z archives from untrusted sources using the
SevenZipFile() function.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Py7Zr