{"id":168710,"date":"2026-04-14T17:12:53","date_gmt":"2026-04-14T15:12:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda"},"modified":"2026-04-14T17:12:53","modified_gmt":"2026-04-14T15:12:53","slug":"uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-python-bibliotekah-lzma-bz2-i-gzip-potenczialno-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"A vulnerability in Python libraries lzma, bz2, and gzip, which could potentially lead to code execution.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
There is a vulnerability (CVE-2026-6100) identified in the decompression classes provided with CPython for compressed data formats lzma, bz2, and gzip (lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile), which leads to access to memory after it has been freed. The issue has been assigned a critical severity level (9.1 out of 10) \u2014 if successfully exploited, this vulnerability may result in information leakage from the process memory or the execution of attacker's code during the decompression of specially crafted data. The fix is currently available in the form of a patch. <\/p>\n
The problem manifests after the memory allocation operation is terminated by an error occurring due to insufficient memory (for the vulnerability to be successfully exploited, the attacker must create conditions that exhaust the memory available to the process). Accessing already freed memory occurs in applications that reuse an object instance after an error is returned during decompression. Applications that create a new object instance on each call are not susceptible to the vulnerability. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"