Vulnerability in Python Software Foundation Cpython
CVE-2025-8194
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.007 (49.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 49.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
- Python Software Foundation Cpython — versions 3.10.0, 0, 3.14.0a1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/python/cpython/issues/130577 (issue-tracking)
- github.com/python/cpython/pull/137027 (patch)
- mail.python.org/archives/list/security-announce@python.org/thread/ZULLF3IZ726XP… (vendor-advisory)
- github.com/python/cpython/commit/7040aa54f14676938970e10c5f74ea93cd56aa38 (patch)
- github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe (patch)
- gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (mitigation)
- github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f (patch)
- github.com/python/cpython/commit/fbc2a0ca9ac8aff6887f8ddf79b87b4510277227 (patch)
- github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2 (patch)
- github.com/python/cpython/commit/73f03e4808206f71eb6b92c579505a220942ef19 (patch)
Frequently asked questions
- What is CVE-2025-8194?
- CVE-2025-8194 is a high-severity vulnerability in Python Software Foundation Cpython, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2025-07-28.
- How severe is CVE-2025-8194?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-8194 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.