CVE-2025-8194
📋 TL;DR
A vulnerability in CPython's tarfile module allows malicious tar archives with negative offsets to cause infinite loops and deadlocks during extraction or enumeration. This affects any Python application that processes untrusted tar files using the vulnerable TarFile APIs. The vulnerability can lead to denial of service conditions.
💻 Affected Systems
- CPython (Python programming language)
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through resource exhaustion (CPU/memory) when processing malicious archives, potentially crashing applications or making services unavailable.
Likely Case
Application hangs or becomes unresponsive when processing specially crafted tar files, requiring manual intervention to restore service.
If Mitigated
With proper input validation and patching, the vulnerability is eliminated and tar processing functions normally.
🎯 Exploit Status
Creating malicious tar archives with negative offsets is straightforward. The gist reference provides example code demonstrating the issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions containing commits: 57f5981d6260ed21266e0c26951b8564cc252bc2, 7040aa54f14676938970e10c5f74ea93cd56aa38, 73f03e4808206f71eb6b92c579505a220942ef19, b4ec17488eedec36d3c05fec127df71c0071f6cb
Vendor Advisory: https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2
Restart Required: No
Instructions:
1. Update Python to a version containing the fix commits. 2. For immediate mitigation, apply the patch from the gist after importing tarfile module. 3. Test tar processing functionality after patching.
🔧 Temporary Workarounds
Apply runtime patch
allApply the provided gist patch after importing tarfile module to reject archives with negative offsets
# Apply the patch from: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
# Copy the patch code and execute it after 'import tarfile' in your application
Input validation wrapper
allCreate a wrapper function that validates tar files before processing
def safe_tar_extract(tar_path, extract_path):
import tarfile
# Add validation logic here
# Check file size, structure before processing
with tarfile.open(tar_path) as tar:
tar.extractall(extract_path)
🧯 If You Can't Patch
- Implement strict input validation for all tar file processing - reject files from untrusted sources
- Monitor application logs for tar processing hangs and implement automatic restart mechanisms for affected services
🔍 How to Verify
Check if Vulnerable:
Test with a crafted tar file containing negative offsets. If the application hangs or enters infinite loop, it's vulnerable.Check Version:
python --version or python -c "import tarfile; print(tarfile.__file__)" to check module locationVerify Fix Applied:
After patching, test with the same malicious tar file - it should raise an error instead of hanging.📡 Detection & Monitoring
Log Indicators:
- Application hangs during tar processing
- High CPU usage by Python processes handling tar files
- Timeout errors in tar-related operations
Network Indicators:
- Unusually large number of tar file uploads to vulnerable endpoints
- Repeated connection attempts to tar processing services
SIEM Query:
source="application.logs" AND ("tarfile" OR ".tar" OR ".tar.gz") AND ("hang" OR "timeout" OR "high_cpu")🔗 References
- https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
- https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2
- https://github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38
- https://github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19
- https://github.com/python/cpython/commit/b4ec17488eedec36d3c05fec127df71c0071f6cb
- https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f
- https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe
- https://github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227
- https://github.com/python/cpython/issues/130577
- https://github.com/python/cpython/pull/137027
- https://mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP5EY7XJ7YIN3K5MDYR2D/
- http://www.openwall.com/lists/oss-security/2025/07/28/1
- http://www.openwall.com/lists/oss-security/2025/07/28/2
