CVE-2026-55206
Description
A flaw was found in py7zr, a Python library for 7zip archives. A remote attacker could exploit this vulnerability by providing a specially crafted .7z archive. This archive, when processed by the SevenZipFile.init() function, triggers an inefficient algorithmic complexity (CWE-407) during header parsing. This leads to excessive CPU consumption, resulting in a Denial of Service (DoS) for any application that opens untrusted .7z archives using py7zr.
Statement
This Moderate severity flaw in the py7zr library can lead to a Denial of Service. Applications that utilize py7zr to open or process untrusted .7z archives are vulnerable to excessive CPU consumption. This occurs due to an inefficient algorithm when parsing specially crafted archive headers, allowing a remote attacker to trigger the resource exhaustion without requiring file extraction.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
