CVE-2026-55195
NoneCVSS
—
EPSS
0.3%
Published
Jul 8, 2026
CISA due date
—
The record
py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | python-py7zr | 0 | 1.0.0-bp160.2.1 |
| openSUSE:Tumbleweed | python-py7zr | 0 | 1.1.3-1.1 |
Related vulnerabilities
- CVE-2026-55206 py7zr is a Python-based library and utility to support 7zip archive compression… Also affects python-py7zr
- CVE-2026-23879 py7zr is a Python-based library and utility to support 7zip archive compression… Also affects python-py7zr
- CVE-2025-6176 Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a… Also affects python-py7zr
- CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409