01 Record

CVE-2026-6100

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

CriticalPUBLISHEDCNA: PSF

CNA base score9.1 CVSS v4.0CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

View raw JSON

02 Description

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.58% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 45.3% of scored records. A rank, not a probability.

NVD base score

9.1 (CVSS v4.0), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD analysis status

Awaiting Analysis. NVD last modified this record on 2026-08-13.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-04-13 17:15Z4 MO AGO

Last updated

2026-08-13 00:27Z22 DAYS AGO

Reserved

2026-04-10

Assigning CNA

PSF

Record state

PUBLISHED

Severity

Critical (CVSS 9.1)

CNA CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Weaknesses

CWE-416Use After FreeVariant
CWE-787Out-of-bounds WriteBase
CWE-825Expired Pointer DereferenceBase

Data version

5.2

Document digest

a6c8633a66aeb1462f29e65ccc34c12228d8039ccdcab972e58e8a99342ac0c4

05 Affected products

VendorProductVersionsPlatforms

Python Software FoundationCPython0 to < 3.10.21, 3.11.0 to < 3.11.16, 3.12.0 to < 3.12.14, 3.13.0 to < 3.13.14, 3.14.0a1 to < 3.14.5rc1, 3.15.0a1 to < 3.15.0b1—

06 References

github.comhttps://github.com/python/cpython/pull/148396patch
mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/vendor-advisory
github.comhttps://github.com/python/cpython/issues/148395issue-tracking
github.comhttps://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437dpatch
github.comhttps://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2patch
github.comhttps://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20patch
github.comhttps://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0epatch
github.comhttps://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8bpatch
github.comhttps://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3patch
www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/04/13/10
access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-6100vdb-entryx_refsource_REDHAT
bugzilla.redhat.comRHBZ#2457932https://bugzilla.redhat.com/show_bug.cgi?id=2457932issue-trackingx_refsource_REDHAT
security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.jsonx_sadp-csaf-vex
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:52400vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:13812vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:16699vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10711vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19064vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19019vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:11077vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:11062vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10950vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19590vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:17619vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19549vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26187vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19571vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19570vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:13692vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:21682vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:14653vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:17525vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19576vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:14652vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:14656vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10949vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10774vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10745vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19216vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19175vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19177vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:19176vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:25096vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:30078vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:30089vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:30088vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:30087vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10140vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10141vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:8822vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:8824vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:10117vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:9228vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:11768vendor-advisoryx_refsource_REDHAT
access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:21275vendor-advisoryx_refsource_REDHAT

01 Record index

CVE-2026-6100

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2026-6100

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References