CVE-2025-13462: Python

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Affected products

• Python Python: before 3.13.13 (fixed in 3.13.13); from 3.14.0, before 3.14.4 (fixed in 3.14.4); version 3.15.0 only

Published 2026-03-12. Last modified 2026-08-13.