CVE-2026-6100: Python Software Foundation Cpython

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Affected products

Python Software Foundation Cpython: before 3.10.21 (fixed in 3.10.21); from 3.11.0, before 3.11.16 (fixed in 3.11.16); from 3.12.0, before 3.12.14 (fixed in 3.12.14); from 3.13.0, before 3.13.14 (fixed in 3.13.14); from 3.14.0a1, before 3.14.5rc1 (fixed in 3.14.5rc1); from 3.15.0a1, before 3.15.0b1 (fixed in 3.15.0b1)
Red Hat Red Hat Ai Inference Server 3.2: before 1780681984 (fixed in 1780681984)
Red Hat Red Hat Ai Inference Server 3.3: before 1782352950 (fixed in 1782352950); before 1782352919 (fixed in 1782352919); before 1782353093 (fixed in 1782353093); before 1782352847 (fixed in 1782352847)
Red Hat Red Hat Enterprise Linux 10: before 0:3.12.12-3.el10_1.3 (fixed in 0:3.12.12-3.el10_1.3); before 0:3.14.4-2.el10_2 (fixed in 0:3.14.4-2.el10_2)
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 0:3.12.9-2.el10_0.9 (fixed in 0:3.12.9-2.el10_0.9)
Red Hat Red Hat Enterprise Linux 6
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8: before 0:3.12.13-2.el8_10 (fixed in 0:3.12.13-2.el8_10); before 0:3.11.13-7.el8_10 (fixed in 0:3.11.13-7.el8_10); before 0:3.6.8-76.el8_10 (fixed in 0:3.6.8-76.el8_10)
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: before 0:3.6.8-39.el8_4.11 (fixed in 0:3.6.8-39.el8_4.11)
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: before 0:3.6.8-39.el8_4.11 (fixed in 0:3.6.8-39.el8_4.11)
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: before 0:3.6.8-47.el8_6.13 (fixed in 0:3.6.8-47.el8_6.13)
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: before 0:3.6.8-47.el8_6.13 (fixed in 0:3.6.8-47.el8_6.13)
Red Hat Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions: before 0:3.6.8-47.el8_6.13 (fixed in 0:3.6.8-47.el8_6.13)
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: before 0:3.6.8-51.el8_8.15 (fixed in 0:3.6.8-51.el8_8.15); before 0:3.11.2-2.el8_8.10 (fixed in 0:3.11.2-2.el8_8.10)
Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions: before 0:3.6.8-51.el8_8.15 (fixed in 0:3.6.8-51.el8_8.15); before 0:3.11.2-2.el8_8.10 (fixed in 0:3.11.2-2.el8_8.10)
Red Hat Red Hat Enterprise Linux 9: before 0:3.12.12-4.el9_7.3 (fixed in 0:3.12.12-4.el9_7.3); before 0:3.11.13-5.3.el9_7 (fixed in 0:3.11.13-5.3.el9_7); before 0:3.9.25-3.el9_7.3 (fixed in 0:3.9.25-3.el9_7.3); before 0:3.14.4-2.el9_8 (fixed in 0:3.14.4-2.el9_8)
Red Hat Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions: before 0:3.9.10-4.el9_0.11 (fixed in 0:3.9.10-4.el9_0.11)
Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:3.11.2-2.el9_2.12 (fixed in 0:3.11.2-2.el9_2.12); before 0:3.9.16-1.el9_2.14 (fixed in 0:3.9.16-1.el9_2.14)
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support: before 0:3.11.7-1.el9_4.13 (fixed in 0:3.11.7-1.el9_4.13); before 0:3.12.1-4.el9_4.13 (fixed in 0:3.12.1-4.el9_4.13); before 0:3.9.18-3.el9_4.13 (fixed in 0:3.9.18-3.el9_4.13)
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: before 0:3.11.11-2.el9_6.7 (fixed in 0:3.11.11-2.el9_6.7); before 0:3.12.9-1.el9_6.8 (fixed in 0:3.12.9-1.el9_6.8); before 0:3.9.21-2.el9_6.6 (fixed in 0:3.9.21-2.el9_6.6)
Red Hat Red Hat Enterprise Linux Ai 3.3: before 1776871984 (fixed in 1776871984); before 1776871985 (fixed in 1776871985); before 1776872005 (fixed in 1776872005); before 1776773390 (fixed in 1776773390); before 1776871987 (fixed in 1776871987); before 1776773505 (fixed in 1776773505); …
Red Hat Red Hat Enterprise Linux Ai Rhel Ai 3
Red Hat Red Hat Hardened Images: before 3.13.13-1.1.hum1 (fixed in 3.13.13-1.1.hum1); before 3.11.15-4.hum1 (fixed in 3.11.15-4.hum1); before 3.12.13-3.hum1 (fixed in 3.12.13-3.hum1); before 3.14.4-2.hum1 (fixed in 3.14.4-2.hum1)
Red Hat Red Hat Update Infrastructure 5: before 1777459441 (fixed in 1777459441); before 1777454300 (fixed in 1777454300); before 1777459504 (fixed in 1777459504); before 1779798159 (fixed in 1779798159); before 1779798164 (fixed in 1779798164); before 1779798165 (fixed in 1779798165); …
Red Hat Rhel-8 Based Middleware Containers: before 7.13.5-4.1777325677 (fixed in 7.13.5-4.1777325677); before 7.13.5-4.1777325711 (fixed in 7.13.5-4.1777325711); before 7.13.5-4.1777325710 (fixed in 7.13.5-4.1777325710); before 7.13.5-3.1777325680 (fixed in 7.13.5-3.1777325680); before 7.13.5-4.1777325709 (fixed in 7.13.5-4.1777325709); before 7.13.5-4.1777325680 (fixed in 7.13.5-4.1777325680); …

Published 2026-04-13. Last modified 2026-08-13.