Skip to content

gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor - #148396

Merged
gpshead merged 4 commits into
python:mainfrom
StanFromIreland:mem-stale
Apr 13, 2026
Merged

gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor#148396
gpshead merged 4 commits into
python:mainfrom
StanFromIreland:mem-stale

Conversation

@StanFromIreland

@StanFromIrelandStanFromIreland commented Apr 11, 2026•
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

@bedevere-appbedevere-appBot mentioned this pull request Apr 11, 2026
Closed
emmatyping
emmatyping approved these changes Apr 11, 2026
View reviewed changes

@emmatypingemmatyping left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for fixing this!

@picnixzpicnixz changed the title gh-148395: Fix a possible UAF in {LZMA, BZ2, _Zlib}Decompressorgh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}DecompressorApr 11, 2026
picnixz
picnixz reviewed Apr 11, 2026
View reviewed changes
Comment threadLib/test/test_bz2.py Outdated
@gpshead
gpshead merged commit 8fc66ae into python:mainApr 13, 2026
54 checks passed
@gpsheadgpshead added awaiting merge needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 13, 2026
@miss-islington-app

miss-islington-appBot commented Apr 13, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app

miss-islington-appBot commented Apr 13, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland@miss-islington
pythongh-148395: Fix a possible UAF in{LZMA,BZ2,_Zlib}Decompressor(…
5b8d240
…pythonGH-148396)
Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)
Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app

bedevere-appBot commented Apr 13, 2026

Copy link
Copy Markdown

GH-148479 is a backport of this pull request to the 3.13 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.13 bugs and security fixes label Apr 13, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland@miss-islington
pythongh-148395: Fix a possible UAF in{LZMA,BZ2,_Zlib}Decompressor(…
c8d8173
…pythonGH-148396)
Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)
Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app

bedevere-appBot commented Apr 13, 2026

Copy link
Copy Markdown

GH-148480 is a backport of this pull request to the 3.14 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Apr 13, 2026
gpshead pushed a commit that referenced this pull request Apr 13, 2026
@miss-islington@StanFromIreland
[3.13]gh-148395: Fix a possible UAF in{LZMA,BZ2,_Zlib}Decompressor(
c3cf71c
GH-148396) (#148479)
gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)
Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)
Co-authored-by: Stan Ulbrych <stan@python.org>
gpshead pushed a commit that referenced this pull request Apr 13, 2026
@miss-islington@StanFromIreland
[3.14]gh-148395: Fix a possible UAF in{LZMA,BZ2,_Zlib}Decompressor(
6a5f79c
GH-148396) (#148480)
gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)
Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)
Co-authored-by: Stan Ulbrych <stan@python.org>
This was referenced Jun 29, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
This was referenced Jul 13, 2026
Closed
Closed
Closed
Closed
@LEEKIYOON-SECLEEKIYOON-SEC mentioned this pull request Jul 18, 2026
Open
This was referenced Jul 20, 2026
Closed
Closed
Closed
Closed
camachat pushed a commit to camachat/freebsd-ports that referenced this pull request Jul 22, 2026
@mandreeDaniel Engberg
lang/python314: Security update + other fixes
f5d0864
Fix critical use-after-free bug in LZMA/BZ2/ZLib decompressor routines
when reusing decompressor instances after a MemoryError was raised from
one.
While here:
- fix DEBUG build/package (several %%ABI%% were in the wrong place
in pkg-plist that caused failed installs)
- switch to using system textproc/expat2 library
- issue warnings in pre-test that IPV6, PYMALLOC are required and
DEBUG also breaks one self-test
- bump PORTREVISION
- drop LTOFULL again and make LTO use =full
References:
https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3https://www.cve.org/CVERecord?id=CVE-2026-6100python/cpython#148396
Obtained from:	GitHub repo
python/cpython@c8d8173
Security:	CVE-2026-6100
b8e9f33c-375d-11f1-a119-e36228bfe7d4
camachat pushed a commit to camachat/freebsd-ports that referenced this pull request Jul 24, 2026
@mandreeDaniel Engberg
lang/python314: Security update + other fixes
0a475f4
Fix critical use-after-free bug in LZMA/BZ2/ZLib decompressor routines
when reusing decompressor instances after a MemoryError was raised from
one.
While here:
- fix DEBUG build/package (several %%ABI%% were in the wrong place
in pkg-plist that caused failed installs)
- switch to using system textproc/expat2 library
- issue warnings in pre-test that IPV6, PYMALLOC are required and
DEBUG also breaks one self-test
- bump PORTREVISION
- drop LTOFULL again and make LTO use =full
References:
https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3https://www.cve.org/CVERecord?id=CVE-2026-6100python/cpython#148396
Obtained from:	GitHub repo
python/cpython@c8d8173
Security:	CVE-2026-6100
b8e9f33c-375d-11f1-a119-e36228bfe7d4
@Vamsi-kluVamsi-klu mentioned this pull request Jul 26, 2026
Closed
4 tasks
This was referenced Jul 27, 2026
Closed
Closed
Closed
Closed
Open
Open
Open
Open
Yhg1s pushed a commit that referenced this pull request Aug 4, 2026
@miss-islington@StanFromIreland
[3.12]gh-148395: Fix a possible UAF in{LZMA,BZ2,_Zlib}Decompressor(
ea8d735
GH-148396) (#148503)
* gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)
Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)
Co-authored-by: Stan Ulbrych <stan@python.org>
@LEEKIYOON-SECLEEKIYOON-SEC mentioned this pull request Aug 5, 2026
Open
5 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpsheadgpsheadgpshead approved these changes
@emmatypingemmatypingemmatyping approved these changes
@picnixzpicnixzAwaiting requested review from picnixz

Assignees

@gpsheadgpshead

Labels

awaiting mergetype-securityA security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@StanFromIreland@bedevere-bot@sethmlarson@gpshead@emmatyping@picnixz