CVE-2026-55206: 
Python vulnerability analysis and mitigation

CVE-2026-55206 is a Denial of Service vulnerability in py7zr, a Python library for 7zip archive handling, caused by an O(n²) algorithmic complexity flaw in PackInfo._read() within archiveinfo.py. All versions up to and including 1.1.2 are affected; the issue was fixed in version 1.1.3. The vulnerability was disclosed on June 19, 2026, via a GitHub Security Advisory, and subsequently registered with NVD on July 8, 2026. It carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-407 (Inefficient Algorithmic Complexity) and CWE-606 (Unchecked Input for Loop Condition). The vulnerable code in PackInfo._read() computes pack positions using a list comprehension: self.packpositions = [sum(self.packsizes[:i]) for i in range(self.numstreams + 1)], where numstreams is read directly from the attacker-controlled archive header via read_uint64() without validation. Each iteration re-sums from the beginning of the list, producing O(n²) total work that executes during SevenZipFile.__init__() — before any extraction occurs — making it trivially triggerable by simply opening a crafted archive. The fix replaces this with an O(n) cumulative sum using itertools.accumulate and enforces a MAX_NUMSTREAMS limit of 65536 (Github Advisory, Patch Commit).

Successful exploitation causes excessive CPU consumption on any system that processes attacker-supplied .7z archives using py7zr, resulting in a denial of service. A crafted 50 KB archive can consume approximately 7 seconds of CPU time per parse attempt; scaling numstreams further amplifies the impact proportionally. There is no confidentiality or integrity impact — the vulnerability is limited to availability, but it can be used to exhaust server resources in applications that automatically process uploaded or received archives (Github Advisory).

1. Craft malicious archive: Use py7zr's internal write_uint64 and PROPERTY APIs to construct a minimal .7z archive with a very large numstreams value (e.g., 65535 or higher) encoded in the PACK_INFO header section, with each stream size set to 1 byte.
2. Minimize file size: The crafted archive can be as small as ~50 KB while still triggering significant CPU consumption, making it easy to deliver via file upload, email attachment, or network transfer.
3. Deliver to target: Submit the crafted archive to any application or service that uses py7zr to open or inspect .7z files — no extraction step is required; simply calling SevenZipFile(archive) triggers the vulnerability.
4. Trigger DoS: When the target application initializes SevenZipFile, PackInfo._read() executes the O(n²) cumulative sum loop, consuming excessive CPU. Repeated submissions can sustain resource exhaustion and deny service to legitimate users (Github Advisory).

• Network: Repeated uploads or submissions of small .7z files (≤100 KB) to services that process archives, particularly from a single source IP.
• Process: Sustained high CPU usage by Python processes handling archive parsing; worker threads or processes stuck in SevenZipFile.__init__() for abnormally long durations (seconds per file).
• Logs: Application logs showing timeouts or errors during .7z archive initialization; repeated processing of the same or similarly sized archive files without successful completion.
• File System: Presence of small .7z files with unusually large numstreams values in upload directories or temporary processing folders.

Upgrade py7zr to version 1.1.3 or later, which replaces the O(n²) cumulative sum with itertools.accumulate and enforces a MAX_NUMSTREAMS limit of 65536 (py7zr Release, Patch Commit). As a short-term workaround where upgrading is not immediately possible, consider implementing application-level timeouts around archive parsing operations and restricting the sources from which .7z files are accepted. File size limits alone are insufficient since a small archive can trigger the vulnerability.

Red Hat opened a Bugzilla tracking entry (Bug 2498253) for the vulnerability, classifying it as medium severity for their products (Red Hat Bugzilla). openSUSE issued security announcements covering the fix as part of broader Python package updates. Tenable added detection coverage via Nessus plugins (324069, 326080) and cloud/container security scanners. Community reaction has been limited, with no significant social media discussion beyond automated CVE notification accounts.