Back to Database
Status published
Unknown
CVE-2024-6232
Regular-expression DoS when parsing TarFile headers
Vulnerability Description
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6232
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Elias Joakim Myllymäki
- Seth Larson
- Seth Larson
- Gregory P. Smith
References
- https://github.com/python/cpython/pull/121286
- https://github.com/python/cpython/issues/121285
- https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/
- https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06
- https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4
- https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf
- https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373
- https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d
- https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877
- https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4
More from Python Software Foundation
View All →CVE-2025-8291
ZIP64 End of Central Directory (EOCD) Locator record offset not checked
Medium
4.3
CVE-2025-8194
Tarfile infinite loop during parsing with negative member offset
High
7.5
CVE-2025-6075
Quadratic complexity in os.path.expandvars() with user-controlled template
Low
1.8
CVE-2025-6069
HTMLParser quadratic complexity when processing malformed inputs
Medium
4.3
CVE-2025-4517
Arbitrary writes via tarfile realpath overflow
Critical
9.4
Affected Vendor
Python Software Foundation
View all reports →Affected Software
CPython
Vulnerable Versions:
0, 3.9.0, 3.10.0, 3.11.0, 3.12.0, 3.13.0a1
Timeline
Official Publish:
September 3rd, 2024
Last Modified:
November 3rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
No vector data available