Catalogo CVE

CVE-2026-6100

Gravità: Critical · CVSS 9.1
Published: Apr 13, 2026, 6:16:31 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.76% · Oct 22, 2026

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	pypy3	sid	`8.0.1+dfsg-1`	not affected
Debian	pypy3	forky	`8.0.1+dfsg-1`	not affected
Debian	pypy3	trixie	`7.3.19+dfsg-2`	not affected
Debian	pypy3	bookworm	`7.3.11+dfsg-2+deb12u3`	not affected
Debian	python3.11	bookworm	`3.11.2-6+deb12u8`	fixed
Debian	python3.11	bookworm-security	`3.11.2-6+deb12u9`	fixed
Cpe	python3.12	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	idle-python3.12	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-dev	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-minimal	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-stdlib	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12-testsuite	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	libpython3.12t64	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-dev	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-doc	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-examples	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-full	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-minimal	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-nopie	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.12-venv	Not reported	`3.12.3-1ubuntu0.15`	fixed
Cpe	python3.11	Not reported	`3.11.2-6+deb12u8`	fixed
Alpine	python3	3.21	`3.12.14-r0`	fixed
Alpine	python3	3.22	`3.12.14-r0`	fixed
Alpine	python3	3.23	`3.12.14-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	pypy3	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	pypy3	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	pypy3	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	pypy3	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Debian	python3.11	source	bookworm	`3.11.2-6+deb12u8`	not yet assigned	Not reported	Not reported
Cpe	python3.12	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	idle-python3.12	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-dev	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-minimal	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-stdlib	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12-testsuite	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	libpython3.12t64	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-dev	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-doc	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-examples	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-full	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-minimal	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-nopie	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.12-venv	cpe	Not reported	`3.12.3-1ubuntu0.15`	Not reported	Not reported	Not reported
Cpe	python3.11	cpe	Not reported	`3.11.2-6+deb12u8`	Not reported	Not reported	Not reported
Alpine	python3	apk	3.21	`3.12.14-r0`	Not reported	ALPINE-CVE-2026-6100	Not reported
Alpine	python3	apk	3.22	`3.12.14-r0`	Not reported	ALPINE-CVE-2026-6100	Not reported
Alpine	python3	apk	3.23	`3.12.14-r0`	Not reported	ALPINE-CVE-2026-6100	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[idle-python3.11]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-dbg]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-dev]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-minimal]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-stdlib]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[libpython3.11-testsuite]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11]Interessata
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-dbg]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-dev]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-doc]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-examples]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · all · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · all · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-full]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-minimal]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-nopie]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[python3.11-venv]Interessata
Pacchetto sorgente: [python3.11]
Dettagli (4)
- 3.11.2-6+deb12u8 · amd64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u8 · arm64 · bookworm
  Corretta · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · amd64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
- 3.11.2-6+deb12u3 · arm64 · bookworm-security
  Interessata · Corretta: 3.11.2-6+deb12u8
  nvd · python3.11 · debian · bookworm; nvd · python3.11 · debian · 12
[pypy3]Non interessata
Dettagli (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm
[pypy3-dev]Non interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm
[pypy3-doc]Non interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm
- 7.3.11+dfsg-2+deb12u3 · all · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm
[pypy3-lib]Non interessata
Pacchetto sorgente: [pypy3]
Dettagli (2)
- 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm
- 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm
  Non interessata
  nvd · pypy3 · debian · bookworm

Altri risultati

Osservato: Oct 23, 2026, 10:34:20 PM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]