CVE-2026-6100

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6100
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-6100.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-6100
Aliases
Downstream
Related
Published
2026-04-13T17:15:47.606Z
Modified
2026-08-10T08:34:17.918290Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Details

Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.

The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a MemoryError is raised during decompression. Using the helper functions to one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Database specific 
{
    "cna_assigner": "PSF",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6100.json",
    "cwe_ids": [
        "CWE-416",
        "CWE-787"
    ]
}
References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
b092705907c758d4f9742028652c9802f9f03dd3
Introduced
f31a89bb901067dd105b00cfa90523cf7ffdbbdd
Fixed
fd17997c3866d61e0e7bd8201b1d8f35b40a40bd
Fixed
a68a9190498a16ab1a5c9012ef5a70df81a5b328
Fixed
f31a89bb901067dd105b00cfa90523cf7ffdbbdd
Fixed
47128e64f98c3a20271138a98c2922bea2a3ee0e
Fixed
6a5f79c8d7bbf22b083b240910c7a8781a59437d
Fixed
8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
Fixed
c3cf71c3366fe49acb776a639405c0eea6169c20
Fixed
e20c6c9667c99ecaab96e1a2b3767082841ffc8b
Fixed
ea8d735eb084cf8cc021df1a30e90d10a8f052e3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.13.14"
        },
        {
            "introduced": "3.14.0a1"
        },
        {
            "fixed": "3.14.5rc1"
        },
        {
            "introduced": "3.15.0a1"
        },
        {
            "fixed": "3.15.0b1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.9.8
v0.9.9
v1.*
v1.0.1
v1.0.2
v1.1
v1.1.1
v1.2
v1.2b1
v1.2b2
v1.2b3
v1.2b4
v1.3
v1.3b1
v1.4
v1.4b1
v1.4b2
v1.4b3
v1.5
v1.5.1
v1.5.2
v1.5.2a1
v1.5.2a2
v1.5.2b1
v1.5.2b2
v1.5.2c1
v1.5a1
v1.5a2
v1.5a3
v1.5a4
v1.5b1
v1.5b2
v1.6a1
v1.6a2
v2.*
v2.0
v2.0b1
v2.0b2
v2.0c1
v2.1
v2.1a1
v2.1a2
v2.1b1
v2.1b2
v2.1c1
v2.1c2
v2.2a3
v2.3c1
v2.3c2
v2.4
v2.4a1
v2.4a2
v2.4a3
v2.4b1
v2.4b2
v2.4c1
v3.*
v3.0a1
v3.0a2
v3.0a3
v3.0a4
v3.0a5
v3.0b1
v3.0b2
v3.0b3
v3.0rc1
v3.0rc2
v3.0rc3
v3.1
v3.10.0a1
v3.10.0a7
v3.10.0b1
v3.10.0b2
v3.10.0b3
v3.10.0b4
v3.10.0rc1
v3.10.0rc2
v3.10.1
v3.10.10
v3.10.11
v3.10.12
v3.10.13
v3.10.14
v3.10.15
v3.10.16
v3.10.17
v3.10.18
v3.10.19
v3.10.2
v3.10.20
v3.10.3
v3.10.4
v3.10.5
v3.10.6
v3.10.7
v3.10.8
v3.10.9
v3.11.0a3
v3.11.0a4
v3.11.0a5
v3.11.0a6
v3.11.0a7
v3.11.0b1
v3.11.0b2
v3.11.0b3
v3.11.0b4
v3.11.0b5
v3.11.0rc1
v3.11.0rc2
v3.11.1
v3.11.10
v3.11.11
v3.11.12
v3.11.13
v3.11.14
v3.11.15
v3.11.2
v3.11.3
v3.11.4
v3.11.5
v3.11.6
v3.11.7
v3.11.8
v3.11.9
v3.12.0
v3.12.0a1
v3.12.0a2
v3.12.0a3
v3.12.0a4
v3.12.0a5
v3.12.0a6
v3.12.0a7
v3.12.0b1
v3.12.0b2
v3.12.0b3
v3.12.0b4
v3.12.0rc1
v3.12.0rc2
v3.12.0rc3
v3.12.1
v3.12.10
v3.12.11
v3.12.12
v3.12.13
v3.12.2
v3.12.3
v3.12.4
v3.12.5
v3.12.6
v3.12.7
v3.12.8
v3.12.9
v3.13.0
v3.13.0a1
v3.13.0a2
v3.13.0a3
v3.13.0a4
v3.13.0a5
v3.13.0a6
v3.13.0b1
v3.13.0b2
v3.13.0b3
v3.13.0b4
v3.13.0rc1
v3.13.0rc2
v3.13.0rc3
v3.13.1
v3.13.10
v3.13.11
v3.13.12
v3.13.13
v3.13.2
v3.13.3
v3.13.4
v3.13.5
v3.13.6
v3.13.7
v3.13.8
v3.14.0
v3.14.0b1
v3.14.0b2
v3.14.0b3
v3.14.0b4
v3.14.0rc1
v3.14.0rc2
v3.14.0rc3
v3.14.1
v3.14.2
v3.14.3
v3.14.4
v3.15.0a1
v3.15.0a2
v3.15.0a3
v3.15.0a4
v3.15.0a5
v3.15.0a6
v3.15.0a7
v3.15.0a8
v3.1a1
v3.1a2
v3.1b1
v3.1rc1
v3.1rc2
v3.2a1
v3.2a2
v3.2a3
v3.2a4
v3.2b1
v3.2b2
v3.2rc1
v3.2rc2
v3.2rc3
v3.3.0a2
v3.3.0a3
v3.3.0a4
v3.3.0b1
v3.3.0b2
v3.3.0rc1
v3.3.0rc2
v3.3.0rc3
v3.4.0a1
v3.4.0a2
v3.4.0a3
v3.4.0a4
v3.4.0b1
v3.4.0b2
v3.4.0b3
v3.5.0a1
v3.5.0a2
v3.5.0a3
v3.5.0a4
v3.5.0b1
v3.6.0a3
v3.6.0b1
v3.7.0a2
v3.9.0a2

Database specific

vanir_signatures_modified 
"2026-08-10T08:34:17Z"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_bz2module.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "84589999674251724155468361044613684778",
            "length": 2206.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
        "id": "CVE-2026-6100-20b48da3",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_lzmamodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "274786089459037806290187256381705341170",
            "length": 2221.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "id": "CVE-2026-6100-274a173b",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_lzmamodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "137817026754399672328269279492351081878",
            "length": 2174.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e",
        "id": "CVE-2026-6100-3f4ee08e",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_bz2module.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "84589999674251724155468361044613684778",
            "length": 2206.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b",
        "id": "CVE-2026-6100-5345bf48",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_lzmamodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "137817026754399672328269279492351081878",
            "length": 2174.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
        "id": "CVE-2026-6100-59ee1e2b",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_bz2module.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "84589999674251724155468361044613684778",
            "length": 2206.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
        "id": "CVE-2026-6100-643d6667",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/zlibmodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "197439806431788498051156381226726719416",
            "length": 2238.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3",
        "id": "CVE-2026-6100-6e47e0ec",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_lzmamodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "137817026754399672328269279492351081878",
            "length": 2174.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3",
        "id": "CVE-2026-6100-75190ade",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_bz2module.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "285947837918045169759164635510724021861",
            "length": 2244.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "id": "CVE-2026-6100-86dedb9f",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_bz2module.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "84589999674251724155468361044613684778",
            "length": 2206.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e",
        "id": "CVE-2026-6100-906ff074",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_lzmamodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "137817026754399672328269279492351081878",
            "length": 2174.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b",
        "id": "CVE-2026-6100-9cdcb6f4",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_lzmamodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "137817026754399672328269279492351081878",
            "length": 2174.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
        "id": "CVE-2026-6100-9e46e21d",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/zlibmodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "288422572817338439511797407182616984687",
            "length": 2277.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
        "id": "CVE-2026-6100-c16b4d22",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/zlibmodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "197439806431788498051156381226726719416",
            "length": 2238.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
        "id": "CVE-2026-6100-c46813d4",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/zlibmodule.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "197439806431788498051156381226726719416",
            "length": 2238.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
        "id": "CVE-2026-6100-ea7af3c2",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "Modules/_bz2module.c",
            "function": "decompress"
        },
        "digest": {
            "function_hash": "84589999674251724155468361044613684778",
            "length": 2206.0
        },
        "signature_type": "Function",
        "source": "https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3",
        "id": "CVE-2026-6100-fdfa63b1",
        "deprecated": false
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-6100.json"