CVE-2026-15310: 
Python Interpreter vulnerability analysis and mitigation

CVE-2026-15310 is a denial-of-service vulnerability in Python's zipfile module that allows memory exhaustion when decompressing crafted zip files using bzip2, LZMA, or Zstandard compression. The flaw affects CPython versions prior to 3.15.0rc2 (with backports needed for 3.10–3.14), and was disclosed on August 25, 2026. It was originally reported by researcher @tonghuaroot and patched by CPython core developer @encukou. The vulnerability carries a CVSS v4.0 base score of 2.1 (Low) (Github Advisory, Feedly).

The root cause is CWE-400 (Uncontrolled Resource Consumption) in zipfile.ZipExtFile._read1(). While the DEFLATE decompression path correctly bounds output by passing a max_length argument to zlib, the bzip2, LZMA, and Zstandard paths called self._decompressor.decompress(data) with no upper bound. This meant an entire compressed chunk was expanded into a single unbounded memory allocation before the data[:self._left] clip ran — so even a consumer deliberately reading in small chunks (e.g., zf.open(name).read(8192)) received no memory protection for non-DEFLATE members. A spec-conformant archive member declaring a large uncompressed size could therefore drive multi-gigabyte peak memory usage. The fix adds a per-call bound to non-DEFLATE decompress() calls and updates the LZMA wrapper to forward max_length and expose needs_input (CPython PR #156003, CPython Issue #156002).

Successful exploitation results in memory exhaustion on the host running the vulnerable Python process, causing a denial-of-service condition. There is no impact to confidentiality or integrity — the vulnerability is limited to availability of the vulnerable system. Any Python application or service that accepts and decompresses user-supplied zip files using bzip2, LZMA, or Zstandard compression is at risk, including web services, file processing pipelines, and build systems (Github Advisory, CPython Issue #156002).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.30%, placing it in the 26th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim application must actively open and decompress a malicious zip file — and specific deployment conditions must be present (Attack Requirements: Present in CVSS v4.0) (Github Advisory).

1. Craft a malicious zip file: Create a spec-conformant zip archive containing a member compressed with bzip2, LZMA, or Zstandard that declares a very large uncompressed size in its header (e.g., several gigabytes), while the actual compressed payload is small.
2. Deliver the archive: Submit the crafted zip file to a target Python application that accepts user-supplied files and decompresses them using the zipfile module (e.g., via a file upload endpoint, email attachment processor, or build pipeline).
3. Trigger decompression: The target application calls zipfile.ZipFile.open() or similar, causing ZipExtFile._read1() to invoke decompress() on the bzip2/LZMA/Zstandard member without a max_length bound.
4. Exhaust memory: The decompressor expands the entire compressed chunk into a single unbounded allocation, rapidly consuming available system memory and causing the process or host to become unresponsive or crash (CPython PR #156003, CPython Issue #156002).

• Process: Python process exhibiting rapidly growing memory consumption (RSS) when processing zip files, potentially reaching gigabytes before crashing or being killed by the OS OOM killer.
• Logs: Application logs showing OOM errors, MemoryError exceptions, or process crashes coinciding with zip file decompression operations; system logs (e.g., /var/log/syslog) showing OOM killer events targeting Python processes.
• File System: Presence of small, suspicious zip files (low compressed size but large declared uncompressed size) in upload directories or temporary processing folders.
• Network: Repeated upload requests delivering small zip files to file-processing endpoints, potentially as part of a sustained DoS attempt.

The Python Software Foundation has released a fix merged into CPython main (commit f897dbf) on August 24, 2026, with backports targeting Python 3.10 through 3.15 (PRs #156362, #156737–#156741). Users should upgrade to patched releases once available for their branch (3.15.0rc2 or later for 3.15; watch for security releases on 3.10–3.14). As interim workarounds: validate and enforce size limits on zip files before decompression, implement resource limits (e.g., ulimit, cgroups) on processes that decompress untrusted archives, and avoid decompressing untrusted zip files with bzip2/LZMA/Zstandard compression in production without input validation (CPython PR #156003, Github Advisory).

The fix was contributed by researcher @tonghuaroot and landed by CPython core developer @encukou, with review from @StanFromIreland who noted the blurb should be categorized under Security rather than general bugs. The Python security announcement was distributed via the official security-announce@python.org mailing list. Community reaction has been low-key given the limited severity, with no notable media coverage or significant social media discussion observed (CPython PR #156003, Python Security Announce).