Vulnerability in Python Software Foundation Cpython
CVE-2025-8194
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
EPSS: 0.006 (45.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Python Software Foundation Cpython — versions 3.10.0, 0, 3.14.0a1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@python.org (issue-tracking)
- cna@python.org (patch)
- cna@python.org (vendor-advisory)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (mitigation)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
Frequently asked questions
- What is CVE-2025-8194?
- CVE-2025-8194 is a high-severity vulnerability in Python Software Foundation Cpython, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2025-07-28.
- How severe is CVE-2025-8194?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-8194 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.