CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
Attackers can cause memory exhaustion and denial of service by crafting zip files with specific compression algorithms that bypass memory limits in Python's zipfile module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-15310?
CVE-2026-15310 is a low-severity denial of service vulnerability in CPython, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When decompressing crafted zip files using the bzip/LZMA/Zstandard
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion.
Weakness: CWE-400
Which versions are affected by CVE-2026-15310?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8 |
python Bitnami | All versions | 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8 |
python-min Bitnami | All versions | 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8 |
Linux distribution packages (1)
python313 openSUSE:Tumbleweed | All versions | 3.13.15-2.1 |
How do I fix CVE-2026-15310?
Upgrade libpython to a fixed version for your release line: 3.10.22, 3.11.17, 3.12.15 or 3.13.16.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-15310 being exploited?
There is no known exploitation of CVE-2026-15310 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-15310, AZL-98208, AZL-98217, BELL-CVE-2026-15310, BIT-libpython-2026-15310, BIT-python-2026-15310 and 17 more.