CriticalFix available
python3.11, python3.13 and 1 more products — security advisory
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
- Products
- python3.11, python3.13, python3.14
- Affected versions
- 3.11.2-6, 3.11.2-6+deb12u1, 3.11.2-6+deb12u2, 3.11.2-6+deb12u3, 3.11.2-6+deb12u4, 3.11.2-6+deb12u5, 3.11.2-6+deb12u6, 3.11.2-6+deb12u7, 3.13.11-1, 3.13.12-1, 3.13.5-2, 3.13.5-2+deb13u1, 3.13.6-1, 3.13.7-1, 3.13.8-1, 3.13.9-1, 3.14.0-1, 3.14.0-2, 3.14.0-3, 3.14.0-4, 3.14.0-5, 3.14.0~a7-1, 3.14.0~b1-1, 3.14.0~b2-1, 3.14.0~b3-1, 3.14.0~b4-1, 3.14.0~rc1-1, 3.14.0~rc2-1, 3.14.0~rc3-1, 3.14.2-1, 3.14.3-1, 3.14.3-2, 3.14.3-3, 3.14.3-4, 3.14.3-5, 3.14.4-1, 3.14.4-2
- Fixed versions
- 3.11.2-6+deb12u8, 3.13.14-1, 3.13.5-2+deb13u2, 3.14.5~rc1-1
- CVEs
- CVE-2026-6100
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:48 UTC · Revision 2
Source evidence
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
osv:DEBIAN-CVE-2026-6100
python3.11
Fixed versions: 3.11.2-6+deb12u8
python3.13
Fixed versions: 3.13.5-2+deb13u2
python3.13
Fixed versions: 3.13.14-1
python3.14
Fixed versions: 3.14.5~rc1-1
Complete source record
{
"id": "353a5e258497cdf5cb6d8dbc76963444352bd8217dcfb1739714d5a5915d6d2f",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-6100",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-6100",
"summary": "Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
"evidence": "osv:DEBIAN-CVE-2026-6100",
"products": [
{
"name": {
"value": "python3.11",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.11.2-6+deb12u8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "3.11.2-6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u7",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.5-2+deb13u2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3.13.5-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.13.5-2+deb13u1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.14-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.13.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.12-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.8-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.9-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python3.14",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.14.5~rc1-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "3.14.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-5",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~a7-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-5",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.4-2",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2026-6100",
"aliases": [
"DEBIAN-CVE-2026-6100"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.2-6+deb12u8"
}
]
}
],
"package": {
"name": "python3.11",
"purl": "pkg:deb/debian/python3.11?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.11.2-6",
"3.11.2-6+deb12u1",
"3.11.2-6+deb12u2",
"3.11.2-6+deb12u3",
"3.11.2-6+deb12u4",
"3.11.2-6+deb12u5",
"3.11.2-6+deb12u6",
"3.11.2-6+deb12u7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6100.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.5-2+deb13u2"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.13.5-2",
"3.13.5-2+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6100.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.14-1"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.13.11-1",
"3.13.12-1",
"3.13.5-2",
"3.13.6-1",
"3.13.7-1",
"3.13.8-1",
"3.13.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6100.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.5~rc1-1"
}
]
}
],
"package": {
"name": "python3.14",
"purl": "pkg:deb/debian/python3.14?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.14.0-1",
"3.14.0-2",
"3.14.0-3",
"3.14.0-4",
"3.14.0-5",
"3.14.0~a7-1",
"3.14.0~b1-1",
"3.14.0~b2-1",
"3.14.0~b3-1",
"3.14.0~b4-1",
"3.14.0~rc1-1",
"3.14.0~rc2-1",
"3.14.0~rc3-1",
"3.14.2-1",
"3.14.3-1",
"3.14.3-2",
"3.14.3-3",
"3.14.3-4",
"3.14.3-5",
"3.14.4-1",
"3.14.4-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6100.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-27T09:47:37.997009443Z",
"provider": "osv",
"upstream": [
"CVE-2026-6100"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-6100"
]
},
"related_cves": [
{
"value": "CVE-2026-6100",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 461263,
"published_at": "2026-04-13T18:16:31.297+00:00"
}