CVE-2026-9669
highEPSS 0.004 · 36 %ileDEEUUSEPSS · scored 2026-10-18
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (26)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1830CPython: Schwachstelle ermöglicht Denial of ServiceDeutsch2026-06-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CPython ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-libpython-2026-9669bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow2026-06-25vendor · osvUS
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
- BIT-python-2026-9669bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow2026-06-25vendor · osvUS
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
- BIT-python-min-2026-9669bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow2026-06-25vendor · osvUS
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
- PSF-2026-272026-06-08vendor · osvUS
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
also known as (7)
Other names and identifiers for this entity.
- CNNVD-202606-1623cnnvd
- EUVD-2026-35202enisa_euvd
- GHSA-8jvr-397x-xqh9enisa_euvd
- BIT-libpython-2026-9669osv
- BIT-python-2026-9669osv
- BIT-python-min-2026-9669osv
- PSF-2026-27osv
sources
Which sources assert this record, and when.
references (23)
External citations — patches, advisories, analysis.
- https://github.com/python/cpython/tagsPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-9669cnnvd
- https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6enisa_euvd
- https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636enisa_euvd
- https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036eenisa_euvd
- https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6fenisa_euvd
- https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79enisa_euvd
- https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan