CVE-2026-55206

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.

CVSS

No CVSS.

References

Link	Resource
https://github.com/miurahr/py7zr/commit/d7aa3a197d15c75a65b24f796d3a69f83806d3f8
https://github.com/miurahr/py7zr/releases/tag/v1.1.3
https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7
https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) py7zr es una biblioteca y utilidad basada en Python para dar soporte a la compresión, descompresión, cifrado y descifrado de archivos 7zip. Antes de la versión 1.1.3, PackInfo._read() en archiveinfo.py utilizaba un patrón de suma acumulativa O(n^2) para valores de numstreams controlados por el atacante, analizados a partir de las cabeceras del archivo, lo que permitía que un archivo .7z manipulado causara un consumo excesivo de CPU durante SevenZipFile.init() antes de la extracción. Este problema se ha corregido en la versión 1.1.3.

Information

Published : 2026-07-08 21:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-55206

Mitre link : CVE-2026-55206

CVE.ORG link : CVE-2026-55206

JSON object : View

Products Affected

No product.

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-55206", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55206", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:26:52.381780Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "miurahr", "product": "py7zr", "versions": [{"status": "affected", "version": "< 1.1.3"}]}]}], "published": "2026-07-08T21:16:49.987", "references": [{"url": "https://github.com/miurahr/py7zr/commit/d7aa3a197d15c75a65b24f796d3a69f83806d3f8", "source": "security-advisories@github.com"}, {"url": "https://github.com/miurahr/py7zr/releases/tag/v1.1.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7", "source": "security-advisories@github.com"}, {"url": "https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3."}, {"lang": "es", "value": "py7zr es una biblioteca y utilidad basada en Python para dar soporte a la compresi\u00f3n, descompresi\u00f3n, cifrado y descifrado de archivos 7zip. Antes de la versi\u00f3n 1.1.3, PackInfo._read() en archiveinfo.py utilizaba un patr\u00f3n de suma acumulativa O(n^2) para valores de numstreams controlados por el atacante, analizados a partir de las cabeceras del archivo, lo que permit\u00eda que un archivo .7z manipulado causara un consumo excesivo de CPU durante SevenZipFile.init() antes de la extracci\u00f3n. Este problema se ha corregido en la versi\u00f3n 1.1.3."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}