CVE-2026-6100: CPython Use-After-Free in Decompressors Rated…

CVE-2026-6100 affects CPython with a use-after-free in the lzma, bz2, and gzip decompressors. The CVSS 4.0 score is 9.1 CRITICAL, though exploitation requires memory pressure and instance reuse.

On April 13, 2026, the Python Software Foundation registered CVE-2026-6100, a use-after-free vulnerability in CPython's native decompressors that can trigger when a reused instance encounters an out-of-memory condition. The CVSS 4.0 score is 9.1 CRITICAL, placing the bug in the highest severity tier despite narrowly scoped attack conditions: the combination of memory pressure and a specific reuse pattern makes this case an emblematic example of how error-state handling in the world's most widely used runtime is becoming a research target for sophisticated attacks.

Key Takeaways

The CPython classes lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile contain a use-after-free triggerable upon reuse after a MemoryError
The CVSS 4.0 score is 9.1 CRITICAL per the official CVE.org record, with a network vector and total impact on confidentiality and integrity
CISA assessed exploitation as "none" and automatable as "no" in the SSVC framework, indicating no known exploits and difficulty of automated attack
One-shot helper functions such as lzma.decompress() are not vulnerable because they create a new instance for each call

The Mechanism: When Memory Failure Leaves a Ghost Pointer

According to the original advisory's technical description, the bug resides in the lifecycle of CPython decompressor objects: when a memory allocation fails with MemoryError, the internal pointer to the object is not invalidated. Subsequent reuse of the instance in a partially initialized state causes access to already-freed memory, with potential overwriting of heap metadata and execution hijacking. This pattern is classic in systems software but rare in high-level languages like Python, where garbage collection and memory abstraction tend to mask such fragilities.

The trigger condition explicitly requires two concatenated elements: memory pressure causing the allocation to fail, and application logic that reuses the decompressor instance even after the exception is raised. This is not a common scenario in idiomatic Python code, where MemoryError is typically handled as a terminal condition or propagated. However, in batch data processing systems, streaming decompression pipelines, or long-running services with object-pooling patterns, instance reuse is an established practice.

"Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used"
— systemtek.co.uk, reporting the Python Software Foundation's CVE description

Reading the Score: Why CVSS 9.1 with Such Narrow Conditions

The official CVE.org record assigns CVE-2026-6100 a score of 9.1 CRITICAL with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. The combination of network attack (AV:N) and high impact on confidentiality and integrity (VC:H, VI:H) pushes the score upward, despite high attack complexity (AC:H) and the requirement for specific conditions (AT:P, atomicity present). The CVSS 4.0 formula, unlike version 3.1, separates components more cleanly and penalizes complex access conditions less when the technical impact remains total.

NVD instead reports the v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H without explicitly stating the numerical score in the extracted dossier text. The CWEs associated in the NVD record are three: CWE-416 (Use After Free), CWE-787 (Out-of-bounds Write), and CWE-825 (Expired Pointer Dereference), confirming the multi-faceted nature of the bug spanning memory corruption to potential execution flow control.

CISA, through the ADP program, added an SSVC assessment on June 17, 2026 setting exploitation to "none", automatable to "no", and technicalImpact to "total". This triad is significant: technically the bug allows total impact, but no known exploits exist at present and the attack is not scalable through automation. The discrepancy between theoretical severity and immediate operational risk is the heart of the "silent vulnerability" that CVE-2026-6100 represents.

What We Know About Patches and Vendors

The dossier documents a specific fix for Oracle Linux 8: Snyk reports an update of the platform-python package to version 0:3.6.8-76.0.1.el8_10 or later. Red Hat also modified the NVD record on July 14, 2026 adding CPEs for multiple RHEL versions, signaling coverage of the bug in its ecosystem. The dossier does not document commit details or patch releases directly from the Python Software Foundation, nor specific CPython versions affected beyond those implicated by vendor packages.

Snyk's classification positions the component as "bound to the network stack", with attack possible from the Internet. This label does not imply the bug is exploitable via a simple network payload; rather, it indicates that the vulnerable code resides in an execution path within network-facing services, where remotely sourced compressed data reaches CPython decompressors. The distinction is subtle but relevant for assessing the exposure perimeter.

Immediate Actions

Verify whether production code reuses instances of LZMADecompressor, BZ2Decompressor, or GzipFile after exceptions, replacing the pattern with fresh instances or the one-shot functions lzma.decompress(), bz2.decompress(), gzip.decompress()
Apply operating system security updates where available, prioritizing Oracle Linux 8 with platform-python >= 0:3.6.8-76.0.1.el8_10, and monitor Red Hat security channels for affected RHEL versions
Inspect application logs for recurring MemoryError patterns in decompression components, which may indicate memory-pressure conditions that make the theoretical bug triggerable
Prefer one-shot helper functions in new code, as the dossier explicitly excludes them from the attack surface due to the creation of a new instance per invocation

The Boundary Between Garbage Collection and System Security

CVE-2026-6100 reveals a growing tension in modern runtime design: memory abstraction does not eliminate the need for explicit error-state management in the underlying C extensions. CPython, which delegates decompression operations to native libraries with Python bindings, exposes here the fragile boundary between the managed and unmanaged worlds. The Python Software Foundation, acting as CNA, acknowledged the vulnerability promptly, but the nature of the fix — cleaning the dangling pointer in the error condition — is a call to defensive programming practices more common in kernels than in a high-level language.

For DevOps teams and security engineers, the case offers a concrete invitation: audit not only external dependencies but error-handling patterns in your own code, especially where objects with complex internal state are kept alive through exceptional cycles. Exhausted memory is no longer just a reliability problem: in CVE-2026-6100, it is the trigger that transforms a state-management bug into a critical vulnerability.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references