Python -- use-after-free vulnerability in decompressors under memory pressure

2026-04-13 · CVE-2026-6100 · VuXML entry

Seth Larson reports: There is a CRITICAL severity vulnerability affecting CPython. Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error …

Affected versions

• python310 < 3.10.20_3
• python311 < 3.11.15_4
• python312 < 3.12.13_4
• python313 < 3.13.14
• python313t < 3.13.14
• python314 < 3.14.4_1

By system

2 still vulnerable, 6 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.