CVE-2026-55195 py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
Attackers can cause denial of service by submitting crafted 7z archives that expand excessively, exhausting system resources during extraction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55195?
CVE-2026-55195 is a high-severity denial of service vulnerability in miurahr py7zr, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.
Weakness: CWE-409
Which versions are affected by CVE-2026-55195?
3 open source packages ship an affected version, including py7zr.
| Package | Affected | Fixed in |
|---|---|---|
py7zr PyPI | All versions | 1.1.3 |
py7zr PyPI | All versions | 1.1.3 |
py7zr PyPI | All versions | 1.1.3 |
How do I fix CVE-2026-55195?
Upgrade py7zr to 1.1.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-55195 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55195 exists.
Sources
Also known as DEBIAN-CVE-2026-55195, GHSA-gjrg-mpp7-g774, PYSEC-2026-2972, UBUNTU-CVE-2026-55195.