CVE-2026-6100

Use-after-free UAF was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling...

PT-2026-32487

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description A use-after-free flaw exists in the decompression modules of Python, specifically within lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile. This issue occurs when a program re-uses...

Python -- use-after-free vulnerability in decompressors under memory pressure

Seth Larson reports: There is a CRITICAL severity vulnerability affecting CPython. Use-after-free UAF was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be...