Skip to content
Fencer Vulns
high 7.5

CVE-2024-6232 json

Regular-expression DoS when parsing TarFile headers

published 2024-09-03 2 y ago modified 2026-09-22 47 d ago also BIT-libpython-2024-6232 , BIT-python-2024-6232 , BIT-python-min-2024-6232 , EUVD-2024-48018

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Patch / fix

  • bitnami libpython 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6
  • bitnami python 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6
  • bitnami python-min 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6
  • Python Software Foundation CPython 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6, 3.13.0rc2
  • python cpython 3.8.20, 3.9.20, 3.10.15, 3.11.10, 3.12.6, 3.13.0rc2
  • pypy3 Debian 14, Debian 13 7.3.18+dfsg-1
  • python3.11 Debian 12 3.11.2-6+deb12u4
  • python3.13 Debian 13 3.13.0~rc2-1

debian advisories DEBIAN-CVE-2024-6232

  • python2.7 Ubuntu 20.04 LTS 2.7.18-1~20.04.5
  • python2.7 Ubuntu 22.04 LTS 2.7.18-13ubuntu1.3
  • python3.8 Ubuntu 20.04 LTS 3.8.10-0ubuntu1~20.04.12
  • python3.10 Ubuntu 22.04 LTS 3.10.12-1~22.04.6
  • python3.12 Ubuntu 24.04 LTS 3.12.3-1ubuntu0.2
  • python2.7 Ubuntu Pro 14.04 LTS 2.7.6-8ubuntu0.6+esm21
  • python2.7 Ubuntu Pro 16.04 LTS 2.7.12-1ubuntu0~16.04.18+esm12
  • python3.4 Ubuntu Pro 14.04 LTS 3.4.3-1ubuntu1~14.04.7+esm14

ubuntu advisories UBUNTU-CVE-2024-6232

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python3.12 RHEL 10.0 3.12.9-1.el10
  • python3 RHEL 10.0 3.12.9-1.el10
  • python3-idle RHEL 10.0 3.12.9-1.el10
  • python3-libs RHEL 10.0 3.12.9-1.el10
  • python3-test RHEL 10.0 3.12.9-1.el10
  • python3-tkinter RHEL 10.0 3.12.9-1.el10
  • python-unversioned-command RHEL 10.0 3.12.9-1.el10
  • python3.12 RHEL 9 3.12.5-2.el9_5.1

red hat advisories RHBA-2025:6294RHSA-2025:1750RHSA-2024:9451RHSA-2024:9450RHSA-2024:8838RHSA-2024:9468

  • python311 Linux Micro 6.1 3.11.12-slfo.1.1_1.1
  • python311-core Linux Micro 6.1 3.11.12-slfo.1.1_1.1
  • python311 Linux Micro 6.0 3.11.11-1.1
  • python311-core Linux Micro 6.0 3.11.11-1.1
  • python311 Linux Micro 6.0 3.11.8-4.1
  • python311-core Linux Micro 6.0 3.11.8-4.1
  • python3 SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES 15 SP4-LTSS +16 more 3.6.15-150300.10.72.1
  • python3-core SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES 15 SP4-LTSS +18 more 3.6.15-150300.10.72.1

suse advisories SUSE-SU-2025:20374-1SUSE-SU-2025:20154-1SUSE-SU-2025:20065-1SUSE-SU-2024:3470-1SUSE-SU-2024:3447-1SUSE-SU-2024:3430-1

  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python312 openSUSE Tumbleweed 3.12.6-1.1
  • python310 openSUSE Tumbleweed 3.10.15-1.1
  • python311 openSUSE Tumbleweed 3.11.9-7.1
  • python38 openSUSE Tumbleweed 3.8.20-1.1
  • python313 openSUSE Tumbleweed 3.13.0~rc2-1.1
  • python39 openSUSE Tumbleweed 3.9.19-8.1

opensuse advisories openSUSE-SU-2025:15713-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14370-1openSUSE-SU-2024:14345-1openSUSE-SU-2024:14346-1openSUSE-SU-2024:14340-1

  • python3.11 AlmaLinux 9 3.11.9-7.el9_5.1
  • python3.11-idle AlmaLinux 9 3.11.9-7.el9_5.1
  • python3.11-libs AlmaLinux 9 3.11.9-7.el9_5.1
  • python3.11-test AlmaLinux 9 3.11.9-7.el9_5.1
  • python3.11-tkinter AlmaLinux 9 3.11.9-7.el9_5.1
  • python3.12 AlmaLinux 9 3.12.5-2.el9_5.1
  • python3.12-idle AlmaLinux 9 3.12.5-2.el9_5.1
  • python3.12-libs AlmaLinux 9 3.12.5-2.el9_5.1

almalinux advisories ALSA-2024:9450ALSA-2024:9451ALSA-2024:9468ALSA-2024:8836ALSA-2024:8838ALSA-2024:8446

  • python3.12 Rocky Linux 8 3.12.6-1.el8_10
  • python3.11 Rocky Linux 8 3.11.10-1.el8_10
  • python3.11 Rocky Linux 9 3.11.7-1.el9_4.6
  • python3.12 Rocky Linux 9 3.12.1-4.el9_4.4
  • python3.9 Rocky Linux 9 3.9.18-3.el9_4.6
  • numpy Rocky Linux 8 1.19.4-3.module+el8.10.0+1582+bc278001
  • scipy Rocky Linux 8 1.5.4-5.module+el8.10.0+1582+bc278001
  • Cython Rocky Linux 8 0.29.21-5.module+el8.10.0+1582+bc278001

rocky linux advisories RLSA-2024:8836RLSA-2024:8838RLSA-2024:8374RLSA-2024:8447RLSA-2024:8446RLSA-2024:8359

  • python3 Alpine 3.17 3.10.15-r0
  • python3 Alpine 3.19, Alpine 3.18 3.11.10-r0
  • python3 Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 3.12.6-r0

alpine advisories ALPINE-CVE-2024-6232

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python3 Azure Linux 3.0 3.12.3-4
  • python3 CBL-Mariner 2.0 3.9.19-5
  • tensorflow Azure Linux 3.0 2.16.1-7

azure linux advisories AZL-48552AZL-48585AZL-48740

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-6232 updated cvss 7.5

python: cpython: tarfile: ReDos via excessive backtracking while parsing header values

  • Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, tkinter, python-libs, python-test, python-tools
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AI (RHEL AI) bootc-nvidia-rhel9
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder (v. 9) python3 3.9.19-8.el9_5.1, python3.11 3.11.9-7.el9_5.1, python3.12 3.12.5-2.el9_5.1, python3-idle 3.9.19-8.el9_5.1, python3-test 3.9.19-8.el9_5.1, python3-tkinter 3.9.19-8.el9_5.1, +6 more
    fixed: vendor fix RHSA-2024:9468
  • Red Hat CodeReady Linux Builder EUS (v.8.8) python3.11 3.11.2-2.el8_8.4, python3.11-idle 3.11.2-2.el8_8.4, python3.11-test 3.11.2-2.el8_8.4, python3.11-tkinter 3.11.2-2.el8_8.4
    fixed: vendor fix RHSA-2024:7647
  • Red Hat CodeReady Linux Builder EUS (v.9.2) python3 3.9.16-1.el9_2.8, python3.11 3.11.2-2.el9_2.6, python3-idle 3.9.16-1.el9_2.8, python3-test 3.9.16-1.el9_2.8, python3-tkinter 3.9.16-1.el9_2.8, python3.11-idle 3.11.2-2.el9_2.6, +2 more
    fixed: vendor fix RHSA-2024:6909
  • Red Hat Enterprise Linux AppStream (v. 8) python3.12 3.12.6-1.el8_10, python3.11 3.11.10-1.el8_10, python3-idle 3.6.8-67.el8_10, python3-test 3.6.8-67.el8_10, platform-python 3.6.8-67.el8_10, python3-tkinter 3.6.8-67.el8_10, +61 more
    fixed: vendor fix RHSA-2024:8359
  • Red Hat Enterprise Linux AppStream (v. 9) python3.11 3.11.7-1.el9_4.6, python3.11 3.11.9-7.el9_5.1, python3.12 3.12.1-4.el9_4.4, python3.12 3.12.5-2.el9_5.1, python3-tkinter 3.9.18-3.el9_4.6, python3-tkinter 3.9.19-8.el9_5.1, +10 more
    fixed: vendor fix RHSA-2024:8446
  • Red Hat Enterprise Linux AppStream (v. 10) python3-tkinter 3.12.9-1.el10, python-unversioned-command 3.12.9-1.el10
    fixed: vendor fix RHBA-2025:6294
show 23 more
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, PyYAML 5.4.1-1.module+el8.4.0+10484+27ce8e03, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, numpy 1.19.4-2.module+el8.4.0+15042+dc5a279b.1, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:8977
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, PyYAML 5.4.1-1.module+el8.5.0+10613+59a13ec4, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:8797
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, PyYAML 5.4.1-1.module+el8.4.0+10484+27ce8e03, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, numpy 1.19.4-2.module+el8.4.0+15042+dc5a279b.1, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:8977
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, PyYAML 5.4.1-1.module+el8.5.0+10613+59a13ec4, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:8797
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) python3-tkinter 3.9.10-4.el9_0.6, python-unversioned-command 3.9.10-4.el9_0.6
    fixed: vendor fix RHSA-2024:8130
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) python3.11 3.11.2-2.el8_8.4, python3.11-libs 3.11.2-2.el8_8.4, python3.11-tkinter 3.11.2-2.el8_8.4, python3.11-rpm-macros 3.11.2-2.el8_8.4, scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, +53 more
    fixed: vendor fix RHSA-2024:8504
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) python3.11 3.11.2-2.el9_2.6, python3-tkinter 3.9.16-1.el9_2.8, python3.11-libs 3.11.2-2.el9_2.6, python3.11-tkinter 3.11.2-2.el9_2.6, python-unversioned-command 3.9.16-1.el9_2.8
    fixed: vendor fix RHSA-2024:6909
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, PyYAML 5.4.1-1.module+el8.4.0+10484+27ce8e03, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, numpy 1.19.4-2.module+el8.4.0+15042+dc5a279b.1, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:8977
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) scipy 1.5.4-3.module+el8.4.0+9822+20bf1249, numpy 1.19.4-3.module+el8.5.0+12204+54860423, PyYAML 5.4.1-1.module+el8.5.0+10613+59a13ec4, mod_wsgi 4.7.1-4.module+el8.4.0+9822+20bf1249, python-idna 2.10-3.module+el8.4.0+9822+20bf1249, python-ply 3.11-10.module+el8.4.0+9822+20bf1249, +49 more
    fixed: vendor fix RHSA-2024:8797
  • Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-67.el8_10, python3-libs 3.6.8-67.el8_10, python3-test 3.6.8-67.el8_10, platform-python 3.6.8-67.el8_10
    fixed: vendor fix RHSA-2024:6975
  • Red Hat Enterprise Linux BaseOS (v. 9) python3 3.9.18-3.el9_4.6, python3 3.9.19-8.el9_5.1, python3.9 3.9.18-3.el9_4.6, python3.9 3.9.19-8.el9_5.1, python3-libs 3.9.18-3.el9_4.6, python3-libs 3.9.19-8.el9_5.1
    fixed: vendor fix RHSA-2024:8446
  • Red Hat Enterprise Linux BaseOS (v. 10) python3 3.12.9-1.el10, python3.12 3.12.9-1.el10, python3-libs 3.12.9-1.el10
    fixed: vendor fix RHBA-2025:6294
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) python3 3.9.10-4.el9_0.6, python3.9 3.9.10-4.el9_0.6, python3-libs 3.9.10-4.el9_0.6
    fixed: vendor fix RHSA-2024:8130
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) python3 3.9.16-1.el9_2.8, python3.9 3.9.16-1.el9_2.8, python3-libs 3.9.16-1.el9_2.8
    fixed: vendor fix RHSA-2024:6909
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-idle 3.12.9-1.el10, python3-test 3.12.9-1.el10
    fixed: vendor fix RHBA-2025:6294
  • Red Hat Enterprise Linux CRB (v. 8) python3.12 3.12.6-1.el8_10, python3.11 3.11.10-1.el8_10, python3.12-idle 3.12.6-1.el8_10, python3.12-test 3.12.6-1.el8_10, python3.11-idle 3.11.10-1.el8_10, python3.11-test 3.11.10-1.el8_10, +24 more
    fixed: vendor fix RHSA-2024:8359
  • Red Hat Enterprise Linux CRB (v. 9) python3 3.9.18-3.el9_4.6, python3.11 3.11.7-1.el9_4.6, python3.12 3.12.1-4.el9_4.4, python3-idle 3.9.18-3.el9_4.6, python3-test 3.9.18-3.el9_4.6, python3-tkinter 3.9.18-3.el9_4.6, +6 more
    fixed: vendor fix RHSA-2024:8446
  • Red Hat Enterprise Linux Server (v. 7 ELS) python3 3.6.8-21.el7_9.1, python3-libs 3.6.8-21.el7_9.1
    fixed: vendor fix RHSA-2025:1750
  • Red Hat Enterprise Linux Server AUS (v. 7.7) python3 3.6.8-10.el7_7.1, python3-libs 3.6.8-10.el7_7.1
    fixed: vendor fix RHSA-2024:8490
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) python3 3.6.8-21.el7_9.1, python3-idle 3.6.8-21.el7_9.1, python3-test 3.6.8-21.el7_9.1, python3-tkinter 3.6.8-21.el7_9.1
    fixed: vendor fix RHSA-2025:1750
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) python3 3.6.8-10.el7_7.1, python3-idle 3.6.8-10.el7_7.1, python3-test 3.6.8-10.el7_7.1, python3-tkinter 3.6.8-10.el7_7.1
    fixed: vendor fix RHSA-2024:8490
  • Red Hat OpenShift AI 8 rhoai/odh-rhel8-operator v2.13.1-2, rhoai/odh-dashboard-rhel8 v2.13.1-1, rhoai/odh-modelmesh-rhel8 v2.13.1-1, rhoai/odh-operator-bundle v2.13.1-2, rhoai/odh-rhel8-operator v2.14.0-24, rhoai/odh-dashboard-rhel8 v2.14.0-11, +56 more
    fixed: vendor fix RHBA-2024:8413
  • Red Hat Enterprise Linux 8 scipy, python36, python-nose, python-wheel, python3-bson, python3-nose, +19 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-226-15 updated cvss 7.5

Siemens SINEC OS

  • Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.1 Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family < 3.1
    affected: fixed in V3.1 support.industry.siemens.com
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
    not affected

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

2.20% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/python/cpython/issues/121285 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami libpython
<3.8.20
>=3.9.0, <3.9.20
>=3.10.0, <3.10.15
>=3.11.0, <3.11.10
>=3.12.0, <3.12.6
3.8.20
3.9.20
3.10.15
3.11.10
3.12.6
bitnami python
<3.8.20
>=3.9.0, <3.9.20
>=3.10.0, <3.10.15
>=3.11.0, <3.11.10
>=3.12.0, <3.12.6
3.8.20
3.9.20
3.10.15
3.11.10
3.12.6
bitnami python-min
<3.8.20
>=3.9.0, <3.9.20
>=3.10.0, <3.10.15
>=3.11.0, <3.11.10
>=3.12.0, <3.12.6
3.8.20
3.9.20
3.10.15
3.11.10
3.12.6

Affected products

  • Python Software Foundation CPython
  • python cpython

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.