CVE Feed

    Dashboard / CVE / CVE-2024-6232

    CVE-2024-6232

    There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

    Published:Sep 3, 2024
    Last Modified:Nov 3, 2025
    EPS:Sep 3, 2024
    EPSS Score:0.02726
    CVSS Score:7.5

    Affected Products

    Vendor
    Python
    Product
    Cpython
    Vendor
    Python
    Product
    Python
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Els
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Tus

    Exploits

    https://github.com/python/cpython/issues/121285https://github.com/bgutowski/CVE-2025-4517-POC-Sudoers

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-492 Regular Expression Exponential Blowup

    Related CVEs

    CVE-2026-15310 (CVSS 2.1) — When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacke…
    CVE-2026-19672 (CVSS 6.3) — The tarfile module's tar and data extraction filters created directories outside the destination for members…
    CVE-2026-15806 (CVSS 6) — The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRe…
    CVE-2026-17084 (CVSS 6) — The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unico…
    CVE-2026-18503 (CVSS 2.4) — Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and …
    CVE-2026-6879 (CVSS 2) — `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath …
    CVE-2026-15308 (CVSS 8.7) — The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated untermi…
    CVE-2026-4360 (CVSS 2) — In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An a…
    CVE-2026-11972 (CVSS 8.2) — When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not …
    CVE-2026-0864 (CVSS 4.1) — When using the "configparser" module to write configuration files containing multi-line text values with carri…

    References

    https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4
    https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06
    https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4
    https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d
    https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877
    https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf
    https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373
    https://github.com/python/cpython/issues/121285
    https://github.com/python/cpython/pull/121286
    https://mail.python.org/archives/list/[email protected]/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/
    http://www.openwall.com/lists/oss-security/2024/09/03/5
    https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
    https://security.netapp.com/advisory/ntap-20241018-0007/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High