9.1
CVE-2026-6100
- EPSS 0.58%
- Veröffentlicht 13.04.2026 17:15:47
- Zuletzt bearbeitet 13.08.2026 01:16:54
- Erkennungen
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 10
Default Statusaffected
Version
0:3.12.12-3.el10_1.3
Version <
*
Status
unaffected
Version
0:3.12.13-2.el10_2
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 10
Default Statusaffected
Version
0:3.14.4-2.el10_2
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 10.0 Extended Update Support
Default Statusaffected
Version
0:3.12.9-2.el10_0.9
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8
Default Statusaffected
Version
0:3.12.13-2.el8_10
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8
Default Statusaffected
Version
0:3.11.13-7.el8_10
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8
Default Statusaffected
Version
0:3.6.8-76.el8_10
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Default Statusaffected
Version
0:3.6.8-39.el8_4.11
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Default Statusaffected
Version
0:3.6.8-39.el8_4.11
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Default Statusaffected
Version
0:3.6.8-47.el8_6.13
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Default Statusaffected
Version
0:3.6.8-47.el8_6.13
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Default Statusaffected
Version
0:3.6.8-47.el8_6.13
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Default Statusaffected
Version
0:3.6.8-51.el8_8.15
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Default Statusaffected
Version
0:3.11.2-2.el8_8.10
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Default Statusaffected
Version
0:3.6.8-51.el8_8.15
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Default Statusaffected
Version
0:3.11.2-2.el8_8.10
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9
Default Statusaffected
Version
0:3.12.12-4.el9_7.3
Version <
*
Status
unaffected
Version
0:3.12.13-2.el9_8
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9
Default Statusaffected
Version
0:3.11.13-5.3.el9_7
Version <
*
Status
unaffected
Version
0:3.11.13-9.el9_8
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9
Default Statusaffected
Version
0:3.9.25-3.el9_7.3
Version <
*
Status
unaffected
Version
0:3.9.25-7.el9_8
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9
Default Statusaffected
Version
0:3.14.4-2.el9_8
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Default Statusaffected
Version
0:3.9.10-4.el9_0.11
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Default Statusaffected
Version
0:3.11.2-2.el9_2.12
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Default Statusaffected
Version
0:3.9.16-1.el9_2.14
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.4 Extended Update Support
Default Statusaffected
Version
0:3.11.7-1.el9_4.13
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.4 Extended Update Support
Default Statusaffected
Version
0:3.12.1-4.el9_4.13
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.4 Extended Update Support
Default Statusaffected
Version
0:3.9.18-3.el9_4.13
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.6 Extended Update Support
Default Statusaffected
Version
0:3.11.11-2.el9_6.7
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.6 Extended Update Support
Default Statusaffected
Version
0:3.12.9-1.el9_6.8
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 9.6 Extended Update Support
Default Statusaffected
Version
0:3.9.21-2.el9_6.6
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
RHEL-8 based Middleware Containers
Default Statusaffected
Version
7.13.5-4.1777325677
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
RHEL-8 based Middleware Containers
Default Statusaffected
Version
7.13.5-4.1777325711
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
RHEL-8 based Middleware Containers
Default Statusaffected
Version
7.13.5-4.1777325710
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
RHEL-8 based Middleware Containers
Default Statusaffected
Version
7.13.5-3.1777325680
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
RHEL-8 based Middleware Containers
Default Statusaffected
Version
7.13.5-4.1777325709
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
RHEL-8 based Middleware Containers
Default Statusaffected
Version
7.13.5-4.1777325680
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
RHEL-8 based Middleware Containers
Default Statusaffected
Version
7.13.5-4.1777325708
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat AI Inference Server 3.2
Default Statusaffected
Version
1780681984
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat AI Inference Server 3.3
Default Statusaffected
Version
1782352950
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat AI Inference Server 3.3
Default Statusaffected
Version
1782352919
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat AI Inference Server 3.3
Default Statusaffected
Version
1782353093
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat AI Inference Server 3.3
Default Statusaffected
Version
1782352847
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI 3.3
Default Statusaffected
Version
1776871984
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI 3.3
Default Statusaffected
Version
1776871985
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI 3.3
Default Statusaffected
Version
1776872005
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI 3.3
Default Statusaffected
Version
1776773390
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI 3.3
Default Statusaffected
Version
1776871987
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI 3.3
Default Statusaffected
Version
1776773505
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI 3.3
Default Statusaffected
Version
1776938871
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Hardened Images
Default Statusaffected
Version
3.13.13-1.1.hum1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Hardened Images
Default Statusaffected
Version
3.11.15-4.hum1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Hardened Images
Default Statusaffected
Version
3.12.13-3.hum1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Hardened Images
Default Statusaffected
Version
3.14.4-2.hum1
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Update Infrastructure 5
Default Statusaffected
Version
1777459441
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Update Infrastructure 5
Default Statusaffected
Version
1777454300
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Update Infrastructure 5
Default Statusaffected
Version
1777459504
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Update Infrastructure 5
Default Statusaffected
Version
1779798159
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Update Infrastructure 5
Default Statusaffected
Version
1779798164
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Update Infrastructure 5
Default Statusaffected
Version
1779798165
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Update Infrastructure 5
Default Statusaffected
Version
1779798222
Version <
*
Status
unaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 6
Default Statusunknown
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 7
Default Statusunknown
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 7
Default Statusaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux 8
Default Statusunaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI (RHEL AI) 3
Default Statusaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI (RHEL AI) 3
Default Statusaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI (RHEL AI) 3
Default Statusaffected
HerstellerRed Hat
≫
Produkt
Red Hat Enterprise Linux AI (RHEL AI) 3
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.58% | 0.433 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@python.org | 9.1 | 0 | 0 |
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | 8.1 | 2.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-416 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
CWE-825 Expired Pointer Dereference
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://github.com/python/cpython/pull/148396
https://github.com/python/cpython/issues/148395
https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
http://www.openwall.com/lists/oss-security/2026/04/13/10
https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e
https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b
https://bugzilla.redhat.com/show_bug.cgi?id=2457932
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json
https://access.redhat.com/errata/RHSA-2026:10140
https://access.redhat.com/errata/RHSA-2026:10141
https://access.redhat.com/errata/RHSA-2026:11768
https://access.redhat.com/errata/RHSA-2026:21275
https://access.redhat.com/errata/RHSA-2026:25096
https://access.redhat.com/errata/RHSA-2026:30078
https://access.redhat.com/errata/RHSA-2026:30087
https://access.redhat.com/errata/RHSA-2026:30088
https://access.redhat.com/errata/RHSA-2026:30089
https://access.redhat.com/errata/RHSA-2026:13812
https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/
https://access.redhat.com/errata/RHSA-2026:10117
https://access.redhat.com/errata/RHSA-2026:10711
https://access.redhat.com/errata/RHSA-2026:10745
https://access.redhat.com/errata/RHSA-2026:10774
https://access.redhat.com/errata/RHSA-2026:10949
https://access.redhat.com/errata/RHSA-2026:10950
https://access.redhat.com/errata/RHSA-2026:11062
https://access.redhat.com/errata/RHSA-2026:11077
https://access.redhat.com/errata/RHSA-2026:13692
https://access.redhat.com/errata/RHSA-2026:14652
https://access.redhat.com/errata/RHSA-2026:14653
https://access.redhat.com/errata/RHSA-2026:14656
https://access.redhat.com/errata/RHSA-2026:16699
https://access.redhat.com/errata/RHSA-2026:17525
https://access.redhat.com/errata/RHSA-2026:17619
https://access.redhat.com/errata/RHSA-2026:19019
https://access.redhat.com/errata/RHSA-2026:19064
https://access.redhat.com/errata/RHSA-2026:19175
https://access.redhat.com/errata/RHSA-2026:19176
https://access.redhat.com/errata/RHSA-2026:19177
https://access.redhat.com/errata/RHSA-2026:19216
https://access.redhat.com/errata/RHSA-2026:19549
https://access.redhat.com/errata/RHSA-2026:19570
https://access.redhat.com/errata/RHSA-2026:19571
https://access.redhat.com/errata/RHSA-2026:19576
https://access.redhat.com/errata/RHSA-2026:19590
https://access.redhat.com/errata/RHSA-2026:21682
https://access.redhat.com/errata/RHSA-2026:26187
https://access.redhat.com/errata/RHSA-2026:8822
https://access.redhat.com/errata/RHSA-2026:8824
https://access.redhat.com/errata/RHSA-2026:9228
https://access.redhat.com/security/cve/CVE-2026-6100
https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3
https://access.redhat.com/errata/RHSA-2026:52400