CVE-2026-15310
zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
CVE-2026-15310 is fixed in 56 products on 3 platforms, first by DEBIAN-CVE-2026-15310, released September 12, 2026. 10 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: Routine.
RoutineFixed on 3 platforms
CVSS
2.1
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0053
44th percentile
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.13 | 3.13.16 | Python 3.13 3.13.16 | Sep 30, 2026 |
| Python 3.14 | 3.14.8 | Python 3.14 3.14.8 | Sep 30, 2026 |
| Linux | |||
| python3 · sles 15.6 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3 · sles 15.7 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-core · sles 15.6 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3-core · sles 15.7 | 3.6.15-150300.10.129.1 | SUSE-SU-2026:4754-1 | Nov 7, 2026 |
| python3.11 · Debian 12.15 (bookworm) | 3.11.2-6+deb12u9 | DEBIAN-CVE-2026-15310 | Sep 12, 2026 |
| python3.11 · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-debug · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-debuginfo · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-debugsource · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-devel · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-idle · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-libs · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-test · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.11-tkinter · amzn 2023 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 | Nov 7, 2026 |
| python3.12 · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-debug · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-debuginfo · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-debugsource · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-devel · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-idle · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-libs · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-test · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.12-tkinter · amzn 2023 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 | Nov 7, 2026 |
| python3.13 · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-debug · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-debuginfo · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-debugsource · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-devel · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-freethreading · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-freethreading-debug · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-idle · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-libs · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-test · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.13-tkinter · amzn 2023 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 | Nov 7, 2026 |
| python3.14 · Debian 14 | 3.14.7-3 | DEBIAN-CVE-2026-15310 | Sep 12, 2026 |
| python3.14 · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-debug · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-debuginfo · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-debugsource · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-devel · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-freethreading · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-freethreading-debug · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-freethreading-devel · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-freethreading-idle · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-freethreading-libs · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-freethreading-test · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-freethreading-tkinter · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-idle · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-libs · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-test · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.14-tkinter · amzn 2023 | 3.14.8-1.amzn2023.0.1 | ALAS2023-2026-3232 | Nov 7, 2026 |
| python3.15 · Debian 14 | 3.15.0~rc2-1 | DEBIAN-CVE-2026-15310 | Sep 12, 2026 |
| python311 · sles 15.6 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 | Nov 7, 2026 |
| python311 · sles 15.7 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 | Nov 7, 2026 |
| python311-core · sles 15.6 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 | Nov 7, 2026 |
| python311-core · sles 15.7 | 3.11.17-150600.3.74.1 | SUSE-SU-2026:4946-1 | Nov 7, 2026 |
| python312 · sles 15.6 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 | Oct 6, 2026 |
| python312-core · sles 15.6 | 3.12.14-150600.3.68.1 | SUSE-SU-2026:4534-1 | Oct 6, 2026 |
| python313 · sles 15.7 | 3.13.16-150700.4.61.1 | SUSE-SU-2026:4941-1 | Nov 7, 2026 |
| python313-core · sles 15.7 | 3.13.16-150700.4.61.1 | SUSE-SU-2026:4941-1 | Nov 7, 2026 |
| No fix yet | |||
| Python 2 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.10 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.11 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.12 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.5 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.6 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.7 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.8 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.9 (Windows apps) | No fix yet | no-fix | n/a |
| Python3 (macOS) | No fix yet | no-fix | n/a |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.