tarfile: infinite loop in CPython tarfile module (CVE-2025-8194) #shorts

Summary

In today’s episode we cover CVE-2025-8194, a denial of service vulnerability in the CPython tarfile module. Malicious tar archives with negative offsets can trigger an infinite loop and deadlock the parser, impacting any application that uses the built-in TarFile extraction or enumeration APIs.

Product details

This issue affects CPython releases before version 3.13.6 and all 3.14.0 alpha builds up to but not including 3.14.0. Distributions shipping vulnerable versions include Fedora 42 (fixed in python-3.13.6), Fedora 42 mingw-python3, Fedora 41 mingw-python3 (critical backport), openSUSE python39, and SUSE’s Python package.

Vulnerability type summary

CWE-835: Loop with Unreachable Exit Condition. A logic defect in the tar implementation fails to stop processing on negative block offsets, causing an unbounded loop and effectively a denial of service.

Details of the vulnerability

The tarfile module uses a low-level _block method to read archive blocks. A crafted archive can present a negative offset, which the code does not reject. Instead of raising an error, the parser loops indefinitely trying to process the same data. Attackers can send or host malicious tar files to freeze extraction routines or crash background services. A temporary mitigation is to monkey-patch TarInfo._block to raise InvalidHeaderError on negative counts. Upstream fixes in 3.13.6 and 3.14.0 prevent negative offsets altogether.

Conclusion

Users and packagers should upgrade to CPython 3.13.6 or later, or to 3.14.0 when it reaches stable release. Distributions have released advisories and backports—apply those updates immediately. If you cannot upgrade, apply the supplied patch to reject negative offsets in the tarfile module.

Watch the full video on YouTube: CVE-2025-8194

Remediation and exploitation details

This chain involves the following actors

  • Malicious Archive Author: Creates a specially crafted tar archive with negative offsets to trigger the defect
  • Script or Application Developer: Uses the CPython tarfile module to extract or enumerate archives
  • System Administrator or End User: Runs code that invokes tarfile extraction or iteration

This following systems are involved

  • CPython tarfile module (Parsing, enumerating and extracting files from tar archives): Contains the vulnerable TarFile and TarInfo._block logic
  • Target Host Environment (Runs Python interpreter and user applications): Executes maliciously crafted tar extraction leading to denial of service

Attack entry point

Remediation actions

Script or Application Developer
Apply the patch that rejects negative offsets after importing tarfile
CPython tarfile module
System Administrator or End User
Upgrade Python to a non‐vulnerable version
CPython interpreter

Exploitation actions

Create a custom .tar file with manipulated header bytes

Malicious Archive Author
Craft a tar header with a negative data offset in the header fields
CPython tarfile module
Examples:
  • Set the file size or data offset field to a large negative value in octal
  • Append minimal payload so the header is accepted but offset is negative

Call extractall('target-dir') or iterate over tar object

System Administrator or End User
Invoke tarfile extraction or enumeration on the malicious archive
TarFile.extractall() or TarFile.__iter__
Examples:
  • import tarfile with tarfile.open('evil.tar', 'r') as tf: tf.extractall('out/')
  • for entry in tarfile.open('evil.tar'): print(entry.name)

Negative count bypasses boundary checks, never advances file pointer

CPython tarfile module
Process a negative count in TarInfo._block(), enter infinite loop
TarInfo._block
Examples:
  • TarInfo._block(self, count) sees count < 0, loops indefinitely reading same buffer
  • Under threading or synchronous code, this deadlocks the extraction call

Infinite loop causes unresponsive application or thread deadlock

Denial of Service Achieved
Lock up the extraction routine or consume CPU forever
Application or service using tarfile
Examples:
  • Backup scripts hang indefinitely when processing evil.tar
  • Automated deployment stalls on malicious archive

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-8194
Description
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
Provider
PSF
CWE / problem types
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected Software Versions
Python Software Foundation:CPython:[{'version': '0', 'lessThan': '3.13.6', 'status': 'affected', 'versionType': 'python'}, {'version': '3.14.0a1', 'lessThan': '3.14.0', 'status': 'affected', 'versionType': 'python'}]
Date Published
2025-07-28T18:42:44.847Z
Last Updated
2025-08-07T20:16:09.158Z