LowFix available

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

Type: advisorySource: OSV1 source record

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

Announced 11 Sept 2026Group revision 1

Original source ↗

BIT-python-min-2026-15310

Primary source · Revision 2

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-python-min-2026-15310

python-min

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 3.10.22
Source reference: /affected/0/ranges
3.11.17
Source reference: /affected/0/ranges
3.12.15
Source reference: /affected/0/ranges
3.13.16
Source reference: /affected/0/ranges
3.14.8
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.10.22"
          },
          {
            "introduced": "3.11.0"
          },
          {
            "fixed": "3.11.17"
          },
          {
            "introduced": "3.12.0"
          },
          {
            "fixed": "3.12.15"
          },
          {
            "introduced": "3.13.0"
          },
          {
            "fixed": "3.13.16"
          },
          {
            "introduced": "3.14.0"
          },
          {
            "fixed": "3.14.8"
          }
        ]
      }
    ],
    "package": {
      "name": "python-min",
      "purl": "pkg:bitnami/python-min",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V4",
        "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-15310.json"
    }
  }
]