Critical Security Update for Python 3.12: Tarfile Extraction Filter Bypass Vulnerability
Summary
ALSA-2026:59009: Important: python3.12 security update. Affects python3.12 versions < 3.12.14-1.el9_8. Fixed in 3.12.14-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language widely used for various applications, including web development, data analysis, artificial intelligence, and more. It features modules, classes, exceptions, and dynamic data types, making it versatile and powerful. However, it has been found vulnerable to a security issue that allows attackers to bypass tarfile extraction filters, potentially leading to unauthorized access to the filesystem.
Vulnerability Detail
The vulnerability identified as CVE-2026-11940 in Python 3.12 relates to a flaw in the tarfile module, which allows for a bypass of the extraction filter. This means that an attacker could manipulate tar files to extract files outside the intended directory, leading to possible unauthorized access to sensitive files on the system. The implications of this vulnerability are significant, as it could allow attackers to overwrite critical system files or execute malicious scripts.
How To Fix
Minimum fixed version
3.12.14-1.el9_8
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the tarfile module for untrusted tar files until the package is updated. If you must use it, ensure that you validate the contents of the tar file and restrict extraction to a safe directory.
Conclusion
The vulnerability in Python 3.12, identified as CVE-2026-11940, poses significant risks due to its ability to bypass tarfile extraction filters. It is crucial to update to the patched version 3.12.14-1.el9_8 to mitigate these risks. For those unable to update immediately, implementing workarounds is advisable.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2026-11940 is a security vulnerability in Python 3.12 that allows for a bypass of tarfile extraction filters, enabling unauthorized file access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, potential overwriting of critical system files, and execution of malicious scripts.
Yes, a patch is available in the form of an update to Python 3.12 version 3.12.14-1.el9_8.
If you cannot update immediately, avoid using the tarfile module for untrusted files and validate the contents before extraction.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
