CVE-2026-55206

Received Received - Intake

Denial of Service in py7zr via Malformed 7z Archive

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-55206

Affected Vendors & Products

Vendor	Product	Version / Range
py7zr	py7zr	to 1.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the py7zr Python library, which handles 7zip archive compression and decompression. Before version 1.1.3, the function PackInfo._read() used an inefficient O(n^2) cumulative sum pattern when processing the numstreams value from archive headers. An attacker can craft a malicious .7z archive with specially designed numstreams values that cause excessive CPU consumption during the initialization of the SevenZipFile object before extraction.

This means that by providing a malicious archive, an attacker can cause the system using py7zr to spend a large amount of CPU resources, potentially leading to denial of service or degraded performance.

Impact Analysis

The primary impact of this vulnerability is excessive CPU consumption when processing a crafted .7z archive. This can lead to performance degradation or denial of service conditions on systems using vulnerable versions of py7zr prior to 1.1.3.

An attacker could exploit this by sending or causing the system to open a malicious archive, resulting in resource exhaustion and potentially impacting availability of services or applications relying on py7zr.

Mitigation Strategies

To mitigate this vulnerability, upgrade the py7zr library to version 1.1.3 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-55206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70