CVE-2026-55206 py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
A crafted 7z archive can cause excessive CPU consumption in the py7zr library, leading to denial of service during archive initialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55206?
CVE-2026-55206 is a high-severity denial of service vulnerability in miurahr py7zr, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.
Weakness: CWE-407
Which versions are affected by CVE-2026-55206?
3 open source packages ship an affected version, including py7zr.
| Package | Affected | Fixed in |
|---|---|---|
py7zr PyPI | All versions | 1.1.3 |
py7zr PyPI | All versions | 1.1.3 |
py7zr PyPI | All versions | 1.1.3 |
How do I fix CVE-2026-55206?
Upgrade py7zr to 1.1.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-55206 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55206 exists.
Sources
Also known as DEBIAN-CVE-2026-55206, GHSA-h4gh-22qq-72r7, PYSEC-2026-2973, UBUNTU-CVE-2026-55206.