Memory Exhaustion in Python via Crafted Zip Decompression

Executive Summary

This vulnerability involves memory exhaustion when decompressing crafted zip files using bzip2, LZMA, or Zstandard compression methods in Python's zipfile module. An attacker could create a zip file with a small compressed chunk declaring a large uncompressed size, causing excessive memory usage during decompression.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual memory usage spikes when processing zip files, particularly those using bzip2, LZMA, or Zstandard compression. Check Python logs for decompression errors or crashes. Use tools like 'zipinfo' to inspect zip file contents for suspicious compression methods or sizes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to denial-of-service conditions by consuming excessive memory on systems processing crafted zip files. It may cause applications to crash or become unresponsive when handling malicious zip archives.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting system memory, which may impact availability of services handling zip files. For GDPR, this could affect data availability requirements under Article 32. For HIPAA, it may impact the integrity and availability of protected health information systems.

Useful 0 Not Useful 0

Mitigation Strategies

Update Python to a patched version (3.10 or later) that includes the fix for CVE-2026-15310. Avoid processing untrusted zip files, especially those using bzip2, LZMA, or Zstandard compression. Implement input validation to limit file sizes and compression ratios.

Useful 0 Not Useful 0