Skip to content

Stack buffer overflow in bz2 when reusing BZ2Decompressor after error #150599

Closed
Closed
Stack buffer overflow in bz2 when reusing BZ2Decompressor after error#150599
Assignees
StanFromIreland
Labels
extension-modulesC modules in the Modules dirtype-securityA security issue

Description

@StanFromIreland
StanFromIreland
opened on May 30, 2026

Crash report

What happened?

More details to follow.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

Activity

  1. StanFromIreland
    self-assigned this
    on May 30, 2026
  2. StanFromIreland
    added
    extension-modulesC modules in the Modules dir
    type-crashA hard crash of the interpreter, possibly with a core dump
    on May 30, 2026
  3. StanFromIreland
    added this to Compression issues 🗜on May 30, 2026
  4. emmatyping
    added a commit that references this issue on Jun 7, 2026

    gh-150599: Prevent bz2 decompressor reuse after errors (#150600)

    5755d0f
  5. StanFromIreland
    added 3 commits that reference this issue on Jun 7, 2026

    [3.15] gh-150599: Prevent bz2 decompressor reuse after errors (GH-150600

    d3ca269

    [3.14] gh-150599: Prevent bz2 decompressor reuse after errors (#150600)…

    157a5df

    [3.13] gh-150599: Prevent bz2 decompressor reuse after errors (GH-150600

    619a12b
  6. emmatyping
    added
    type-securityA security issue
    on Jun 8, 2026
  7. StanFromIreland
    removed
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Jun 12, 2026
  8. philthompson10
    added a commit that references this issue on Jun 17, 2026

    pythongh-150599: Prevent bz2 decompressor reuse after errors (python#…

    c6f2b1e
  9. pablogsal
    added a commit that references this issue on Jul 4, 2026

    [3.10] gh-150599: Prevent bz2 decompressor reuse after errors (#150600)…

    938ec03
  10. Yhg1s
    added a commit that references this issue on Aug 4, 2026

    [3.12] gh-150599: Prevent bz2 decompressor reuse after errors (#150600)…

    991e6cf
  11. pablogsal
    added a commit that references this issue on Aug 10, 2026

    [3.11] gh-150599: Prevent bz2 decompressor reuse after errors (#150600)…

    1ba6135
  12. StanFromIreland
    closed this as completedon Aug 10, 2026
  13. github-project-automation
    moved this to Done in Compression issues 🗜on Aug 10, 2026
  14. mcepl
    added 4 commits that reference this issue on Sep 18, 2026

    [CVE-2026-9669] Prevent bz2 decompressor reuse after errors

    5ec9886

    [CVE-2026-9669] Prevent bz2 decompressor reuse after errors

    87467a4

    [CVE-2026-9669] Prevent bz2 decompressor reuse after errors

    62db218

    [CVE-2026-9669] Prevent bz2 decompressor reuse after errors

    a8d11b4
  15. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2026-9669] Prevent bz2 decompressor reuse after errors

    79e4d1c

    [CVE-2026-9669] Prevent bz2 decompressor reuse after errors

    330929a

    [CVE-2026-9669] Prevent bz2 decompressor reuse after errors

    b1ee902
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

extension-modulesC modules in the Modules dirtype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions