CVE-2026-11972
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making ar
CVSS
—
No CVSS
EPSS
0.4%
p35
KEV
—
Exploit Today
11
0-100
Published: Jun 23, 2026 · Last modified: Jun 30, 2026 · CWE-252 · CWE-606 · CWE-770
0.3%EPSS · 30 days0.4%
2026-06-302026-07-16
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
- github.comhttps://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9
- github.comhttps://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365
- github.comhttps://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21
- github.comhttps://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec
- github.comhttps://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192
- github.comhttps://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896
- github.comhttps://github.com/python/cpython/issues/151981
- github.comhttps://github.com/python/cpython/pull/151982
- mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-217107.5 HIG97.8%
——29A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.
* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**2dCVE-2026-261307.5 HIG85.0%
——25Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.2dCVE-2026-489337.5 HIG84.9%
——25A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.18hCVE-2026-455917.5 HIG82.4%
——25Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.2dCVE-2021-366307.5 HIG80.5%
——24DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via crafted request.8dCVE-2025-97847.5 HIG80.2%
——24A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).17d