🚨 CVE-2026-15310
When decompressing crafted zip files using the bzip/LZMA/Zstandard
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion.
🎖@cveNotify
GitHub
[3.15] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandar… · python/cpython@1b424c0
…d (GH-156003) (#156362)
Patch by @tonghuaroot.
zipfile.ZipExtFile._read1() bounds the output of each decompress() call
for DEFLATE members by passing a max_length to zlib, but for bzip2, LZMA,
a...
September 4, 2026 23
