Moderate Security Update for Python 3.12: Infinite Loop Vulnerability in Tarfile Parsing
Summary
RLSA-2025:15007: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.9-1.el9_6.2. Fixed in 0:3.12.9-1.el9_6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports modules, classes, exceptions, and dynamic data types, making it suitable for various applications. However, Python 3.12 has been identified with a vulnerability that can lead to an infinite loop when parsing tarfiles, potentially causing denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2025-8194, arises from an infinite loop in the CPython implementation when handling tarfile parsing. This flaw can be exploited by an attacker to create a specially crafted tarfile that, when processed, leads to excessive resource consumption, effectively causing the application to hang or crash. The severity of this vulnerability is reflected in its CVSS score of 7.5, indicating a moderate risk to systems using the affected package.
How To Fix
Minimum fixed version
0:3.12.9-1.el9_6.2
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, the identified vulnerability in Python 3.12 poses a moderate risk due to the potential for denial of service through infinite loop exploitation. It is crucial to update to the patched version to safeguard your applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2025-8194 is a vulnerability in Python 3.12 that causes an infinite loop when parsing tarfiles, potentially leading to denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a moderate level of risk.
While there are no specific workarounds, it is advisable to prioritize updating Python to the patched version as soon as possible to mitigate the risk.
The security fix has been credited to the Rocky Enterprise Software Foundation and Red Hat, who have addressed the vulnerability in the latest package update.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
