Denial of Service in py7zr via Malformed 7z Archive

Compliance Impact

The vulnerability in py7zr (CVE-2026-55206) is a denial-of-service (DoS) issue caused by excessive CPU consumption when processing crafted .7z archives. This can lead to service disruption or degraded availability of systems using the affected library.

While the vulnerability itself does not directly expose personal data or compromise confidentiality or integrity, the resulting DoS could impact the availability aspect of security controls required by standards such as GDPR and HIPAA.

Therefore, organizations relying on py7zr for archive processing should consider this vulnerability in their risk assessments and mitigation strategies to maintain compliance with availability requirements in these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying the use of vulnerable py7zr versions (<=1.1.2) on your system and monitoring for unusually high CPU consumption during the processing of .7z archives.

To detect if a system is vulnerable, check the installed py7zr version with the following command:

• python -m pip show py7zr

If the version is 1.1.2 or earlier, the system is vulnerable.

To detect exploitation attempts or DoS attacks, monitor CPU usage when processing .7z files, especially crafted archives with large numstreams values. You can use system monitoring tools like top, htop, or ps to observe CPU spikes.

Example command to monitor CPU usage of a process:

• top -p $(pgrep -f py7zr)

Additionally, you can attempt to process suspicious .7z files in a controlled environment and observe if the CPU usage spikes significantly (e.g., a 50 KB crafted archive causing around 7 seconds of high CPU usage).

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the py7zr Python library, which handles 7zip archive compression and decompression. Before version 1.1.3, the function PackInfo._read() used an inefficient O(n^2) cumulative sum pattern when processing the numstreams value from archive headers. An attacker can craft a malicious .7z archive with specially designed numstreams values that cause excessive CPU consumption during the initialization of the SevenZipFile object before extraction.

This means that by providing a malicious archive, an attacker can cause the system using py7zr to spend a large amount of CPU resources, potentially leading to denial of service or degraded performance.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is excessive CPU consumption when processing a crafted .7z archive. This can lead to performance degradation or denial of service conditions on systems using vulnerable versions of py7zr prior to 1.1.3.

An attacker could exploit this by sending or causing the system to open a malicious archive, resulting in resource exhaustion and potentially impacting availability of services or applications relying on py7zr.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the py7zr library to version 1.1.3 or later, where the issue has been fixed.

Useful 0 Not Useful 0