CVE-2026-6100 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Attackers can trigger a use-after-free in Python decompression modules under memory pressure, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6100?
CVE-2026-6100 is a critical use after free vulnerability in CPython, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Which versions are affected by CVE-2026-6100?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
python Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
python-min Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
Linux distribution packages (8)
python3 Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
python3-debug Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
python3-debuginfo Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
python3-devel Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
python3-idle Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
python3-libs Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
python3-test Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
python3-tkinter Red Hat:rhel_els:7 | All versions | 0:3.6.8-21.el7_9.7 |
How do I fix CVE-2026-6100?
Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.14.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-6100 being exploited?
There is no known exploitation of CVE-2026-6100 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-6100, AZL-83051, BELL-CVE-2026-6100, BIT-libpython-2026-6100, BIT-python-2026-6100, BIT-python-min-2026-6100 and 22 more.