CVE-2026-6100

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6100
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6100.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6100
Aliases
Downstream
Related
Published
2026-04-13T17:15:47.606Z
Modified
2026-08-14T09:05:41.710816Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Details

Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.

The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a MemoryError is raised during decompression. Using the helper functions to one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Database specific 
{
    "cwe_ids": [
        "CWE-416",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6100.json",
    "cna_assigner": "PSF",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "3.10.21"
                },
                {
                    "introduced": "3.11.0"
                },
                {
                    "fixed": "3.11.16"
                },
                {
                    "introduced": "3.12.0"
                },
                {
                    "fixed": "3.12.14"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
60403a5409ff2c3f3b07dd2ca91a7a3e096839c7
Introduced
b092705907c758d4f9742028652c9802f9f03dd3
Introduced
f31a89bb901067dd105b00cfa90523cf7ffdbbdd
Fixed
fd17997c3866d61e0e7bd8201b1d8f35b40a40bd
Fixed
a68a9190498a16ab1a5c9012ef5a70df81a5b328
Fixed
f31a89bb901067dd105b00cfa90523cf7ffdbbdd
Fixed
47128e64f98c3a20271138a98c2922bea2a3ee0e
Fixed
6a5f79c8d7bbf22b083b240910c7a8781a59437d
Fixed
8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
Fixed
c3cf71c3366fe49acb776a639405c0eea6169c20
Fixed
e20c6c9667c99ecaab96e1a2b3767082841ffc8b
Fixed
ea8d735eb084cf8cc021df1a30e90d10a8f052e3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.13.0"
        },
        {
            "fixed": "3.13.14"
        },
        {
            "introduced": "3.14.0a1"
        },
        {
            "fixed": "3.14.5rc1"
        },
        {
            "introduced": "3.15.0a1"
        },
        {
            "fixed": "3.15.0b1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.13.0
v3.13.1
v3.13.10
v3.13.11
v3.13.12
v3.13.13
v3.13.2
v3.13.3
v3.13.4
v3.13.5
v3.13.6
v3.13.7
v3.13.8
v3.14.0
v3.14.0b1
v3.14.0b2
v3.14.0b3
v3.14.0b4
v3.14.0rc1
v3.14.0rc2
v3.14.0rc3
v3.14.1
v3.14.2
v3.14.3
v3.14.4
v3.15.0a1
v3.15.0a2
v3.15.0a3
v3.15.0a4
v3.15.0a5
v3.15.0a6
v3.15.0a7
v3.15.0a8

Database specific

vanir_signatures_modified 
"2026-08-14T09:05:41Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-6100-20b48da3",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2206.0,
            "function_hash": "84589999674251724155468361044613684778"
        },
        "source": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
        "target": {
            "function": "decompress",
            "file": "Modules/_bz2module.c"
        }
    },
    {
        "id": "CVE-2026-6100-22d654a2",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "94135993539252608169191539438933599202",
                "104669475959108530219517263650155630981",
                "99076997531218567452909478434502041422",
                "333457106311082276385054253937655800853"
            ]
        },
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "target": {
            "file": "Modules/_bz2module.c"
        }
    },
    {
        "id": "CVE-2026-6100-274a173b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2221.0,
            "function_hash": "274786089459037806290187256381705341170"
        },
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "target": {
            "function": "decompress",
            "file": "Modules/_lzmamodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-27d405b9",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "94135993539252608169191539438933599202",
                "104669475959108530219517263650155630981",
                "99076997531218567452909478434502041422",
                "333457106311082276385054253937655800853"
            ]
        },
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "target": {
            "file": "Modules/zlibmodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-3f4ee08e",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2174.0,
            "function_hash": "137817026754399672328269279492351081878"
        },
        "source": "https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e",
        "target": {
            "function": "decompress",
            "file": "Modules/_lzmamodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-42efa811",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "94135993539252608169191539438933599202",
                "104669475959108530219517263650155630981",
                "99076997531218567452909478434502041422",
                "333457106311082276385054253937655800853"
            ]
        },
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "target": {
            "file": "Modules/_lzmamodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-5345bf48",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2206.0,
            "function_hash": "84589999674251724155468361044613684778"
        },
        "source": "https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b",
        "target": {
            "function": "decompress",
            "file": "Modules/_bz2module.c"
        }
    },
    {
        "id": "CVE-2026-6100-59ee1e2b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2174.0,
            "function_hash": "137817026754399672328269279492351081878"
        },
        "source": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
        "target": {
            "function": "decompress",
            "file": "Modules/_lzmamodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-643d6667",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2206.0,
            "function_hash": "84589999674251724155468361044613684778"
        },
        "source": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
        "target": {
            "function": "decompress",
            "file": "Modules/_bz2module.c"
        }
    },
    {
        "id": "CVE-2026-6100-6e47e0ec",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2238.0,
            "function_hash": "197439806431788498051156381226726719416"
        },
        "source": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3",
        "target": {
            "function": "decompress",
            "file": "Modules/zlibmodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-75190ade",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2174.0,
            "function_hash": "137817026754399672328269279492351081878"
        },
        "source": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3",
        "target": {
            "function": "decompress",
            "file": "Modules/_lzmamodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-86dedb9f",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2244.0,
            "function_hash": "285947837918045169759164635510724021861"
        },
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "target": {
            "function": "decompress",
            "file": "Modules/_bz2module.c"
        }
    },
    {
        "id": "CVE-2026-6100-906ff074",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2206.0,
            "function_hash": "84589999674251724155468361044613684778"
        },
        "source": "https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e",
        "target": {
            "function": "decompress",
            "file": "Modules/_bz2module.c"
        }
    },
    {
        "id": "CVE-2026-6100-9cdcb6f4",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2174.0,
            "function_hash": "137817026754399672328269279492351081878"
        },
        "source": "https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b",
        "target": {
            "function": "decompress",
            "file": "Modules/_lzmamodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-9e46e21d",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2174.0,
            "function_hash": "137817026754399672328269279492351081878"
        },
        "source": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
        "target": {
            "function": "decompress",
            "file": "Modules/_lzmamodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-c16b4d22",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2277.0,
            "function_hash": "288422572817338439511797407182616984687"
        },
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "target": {
            "function": "decompress",
            "file": "Modules/zlibmodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-c46813d4",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2238.0,
            "function_hash": "197439806431788498051156381226726719416"
        },
        "source": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
        "target": {
            "function": "decompress",
            "file": "Modules/zlibmodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-ea7af3c2",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2238.0,
            "function_hash": "197439806431788498051156381226726719416"
        },
        "source": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
        "target": {
            "function": "decompress",
            "file": "Modules/zlibmodule.c"
        }
    },
    {
        "id": "CVE-2026-6100-fdfa63b1",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2206.0,
            "function_hash": "84589999674251724155468361044613684778"
        },
        "source": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3",
        "target": {
            "function": "decompress",
            "file": "Modules/_bz2module.c"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6100.json"