Repository navigation
[CVE-2026-6100] Possible UAF in {LZMA,BZ2,_Zlib}Decompressor #148395
Description
See CVE-2026-6100 for more information.
Linked PRs
- gh-148395: Fix a possible UAF in
{LZMA,BZ2,_Zlib}Decompressor#148396 - [3.13] gh-148395: Fix a possible UAF in
{LZMA,BZ2,_Zlib}Decompressor(GH-148396) #148479 - [3.14] gh-148395: Fix a possible UAF in
{LZMA,BZ2,_Zlib}Decompressor(GH-148396) #148480 - [3.12] gh-148395: Fix a possible UAF in
{LZMA,BZ2,_Zlib}Decompressor(GH-148396) #148503 - [3.11] gh-148395: Fix a possible UAF in
{LZMA,BZ2}Decompressor(GH-148396) #148504 - [3.10] gh-148395: Fix a possible UAF in
{LZMA,BZ2}Decompressor(GH-148396) #148505 - gh-148395: Add regression tests for decompressor UAF after MemoryError (CVE-2026-6100) #154713
Metadata
Metadata
Assignees
Projects
- Status
Activity
[-]Possible UAF in `{LZMA, BZ2, _Zlib}Decompressor`[/-][+]Possible UAF in `{LZMA,BZ2,_Zlib}Decompressor`[/+]gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-1…
pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (…
pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (…
[3.13] gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (
[3.14] gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (
Revert "pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decom…
pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (…
[3.11] pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decomp…
pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (…
[-]Possible UAF in `{LZMA,BZ2,_Zlib}Decompressor`[/-][+][CVE-2026-6100] Possible UAF in `{LZMA,BZ2,_Zlib}Decompressor`[/+]14 remaining items
geomcegme commentedon Jun 12, 2026
Hi, is there any update on the expected release of 3.12.14?
We have several vulnerability tickets open for this that have been pending for around two months, and we’re currently unable to close them or provide mitigation guidance without the update.
Any visibility on timeline would be greatly appreciated. Thanks.
StanFromIreland commentedon Jun 12, 2026
Python 3.12 releases are provided on an as-needed basis, at the Release Manager's discretion.
You'll have to apply patches for the vulnerabilities you are affected by.
pythongh-148395: Add Tests NEWS entry for decompressor UAF regression…
pythongh-148395: Avoid Sphinx role nits in Tests NEWS entry
[3.12] gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (
package/python3: security bump to v3.12.14
[CVE-2026-6100] Fix a possible use-after-free in `{LZMA,BZ2,_Zlib}Dec…
[CVE-2026-6100] Fix a possible use-after-free in `{LZMA,BZ2,_Zlib}Dec…
[CVE-2026-6100] Fix a possible use-after-free in `{LZMA,BZ2}Decompres…
[CVE-2026-6100] Fix a possible use-after-free in `{LZMA,BZ2,_Zlib}Dec…
[CVE-2026-6100] Fix a possible use-after-free in `{LZMA,BZ2,_Zlib}Dec…
[CVE-2026-6100] Fix a possible use-after-free in `{LZMA,BZ2,_Zlib}Dec…