Memory Exhaustion Vulnerability in Python3 due to Crafted Zip File Handling
Summary
ALPINE-CVE-2026-15310: When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. Affects python3 versions < 3.12.15-r0. Fixed in 3.12.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python3 is a widely-used programming language known for its simplicity and versatility. It supports various programming paradigms and is used in web development, data analysis, artificial intelligence, scientific computing, and more. However, Python3 has a vulnerability related to the handling of crafted zip files, specifically when decompressing files that utilize bzip, LZMA, or Zstandard compressions. This vulnerability can lead to memory exhaustion, impacting the performance and stability of applications that rely on Python3.
Vulnerability Detail
The vulnerability arises when Python3 decompresses specially crafted zip files that use bzip, LZMA, or Zstandard compressions. An attacker can exploit this by controlling the size of the memory pre-allocation, potentially leading to memory exhaustion. This could result in denial of service for applications using Python3, as they may become unresponsive or crash due to excessive memory consumption. The issue is particularly concerning in environments where Python3 is used to handle untrusted input, making it critical to address.
How To Fix
Minimum fixed version
3.12.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing zip files from untrusted sources or implement strict validation checks on the contents of zip files before decompression to prevent potential exploitation.
Conclusion
The memory exhaustion vulnerability in Python3 due to crafted zip file handling poses significant risks to applications. It is crucial to update to the patched versions to ensure the security and stability of your software. Additionally, employing workarounds and validation measures can help mitigate potential risks until updates are applied.
See every vulnerability recorded for python3 →
FAQ
The vulnerability allows an attacker to control memory allocation during the decompression of crafted zip files, potentially leading to memory exhaustion.
Versions of Python3 prior to 3.12.15-r0 and 3.14.8-r0 for version 3.24 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to denial of service, causing applications to become unresponsive or crash due to excessive memory usage.
While updating is the best solution, you can mitigate risks by avoiding untrusted zip files and implementing validation checks on file contents.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
