CVE-2026-55206: 
Python vulnerability analysis and mitigation

CVE-2026-55206 is a Denial of Service vulnerability in py7zr, a Python library for 7zip archive handling, caused by an O(n²) algorithmic complexity flaw in PackInfo._read() within archiveinfo.py. The vulnerability affects all py7zr versions up to and including 1.1.2, and was disclosed on June 19, 2026, with a fix released the same day in version 1.1.3. It carries a CVSS v4.0 base score of 8.7 (High), reflecting its network-exploitable, unauthenticated, no-user-interaction attack profile (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-407 (Inefficient Algorithmic Complexity) and CWE-606 (Unchecked Input for Loop Condition). The vulnerable code in PackInfo._read() computes pack positions using a list comprehension: self.packpositions = [sum(self.packsizes[:i]) for i in range(self.numstreams + 1)], where numstreams is read directly from the attacker-controlled archive header via read_uint64() without validation. Each iteration re-sums from the beginning of the list, producing O(n²) total work that executes during SevenZipFile.__init__() — before any extraction occurs — meaning simply opening a crafted archive triggers the vulnerability. The fix replaces this with an O(n) implementation using itertools.accumulate and enforces a MAX_NUMSTREAMS limit of 65536 (GitHub Advisory, Patch Commit).

Successful exploitation causes excessive CPU consumption on any system that processes attacker-supplied .7z archives using py7zr, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. A proof-of-concept demonstrates that a crafted 50 KB archive can consume approximately 7 seconds of CPU time per parse, meaning repeated submissions can effectively exhaust server resources with minimal bandwidth cost (GitHub Advisory).

1. Craft malicious archive: Use the public PoC to construct a .7z archive with a large numstreams value encoded in the archive header. The archive body can be minimal (e.g., ~50 KB), as the DoS triggers during header parsing.
2. Encode the numstreams value: Use write_uint64() from py7zr.archiveinfo to encode a large integer (e.g., 65535 or higher) as the numstreams field in the PACK_INFO section of the archive header.
3. Build the archive structure: Construct a valid 7z magic header (\x37\x7a\xbc\xaf\x27\x1c), followed by the crafted HEADER > MAIN_STREAMS_INFO > PACK_INFO block with the inflated numstreams and corresponding SIZE entries.
4. Submit the archive: Deliver the crafted .7z file to any service or application that calls py7zr.SevenZipFile() on user-supplied input (e.g., file upload endpoints, archive processing pipelines).
5. Trigger DoS: Upon SevenZipFile.__init__(), the O(n²) computation in PackInfo._read() executes, consuming excessive CPU before any extraction, causing the process to hang or the service to become unresponsive (GitHub Advisory).

• Process: Python processes consuming sustained high CPU (near 100%) while handling .7z file uploads or archive processing tasks, particularly without corresponding disk I/O activity.
• Logs: Application logs showing SevenZipFile initialization hanging or timing out on specific uploaded files; repeated processing of the same small .7z file with no successful completion.
• File System: Presence of small (< 100 KB) .7z files in upload directories that trigger disproportionate CPU usage when opened; files with unusually large numstreams values in their headers.
• Network: High-frequency submission of small .7z archives to file processing endpoints from a single source IP, consistent with a resource exhaustion attack pattern.

The primary remediation is to upgrade py7zr to version 1.1.3 or later, which replaces the O(n²) cumulative sum with an O(n) itertools.accumulate implementation and enforces a MAX_NUMSTREAMS limit of 65536 (py7zr Release, Patch Commit). As interim workarounds for systems that cannot immediately upgrade, operators should implement timeouts on archive parsing operations, restrict file upload sources, and validate archive file sizes before processing. Rate-limiting archive processing endpoints can also reduce the impact of repeated exploitation attempts.

Red Hat tracked the vulnerability via Bugzilla (Bug 2498253) and classified it as medium severity, with the issue assigned to their Product Security team (Red Hat Bugzilla). openSUSE issued security announcements covering the vulnerability as part of broader Python package updates (openSUSE Security). Tenable added detection coverage via Nessus plugins (324069, 326080) and cloud/container security scanners shortly after disclosure.