CVE-2024-6232

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

• CWE-1333
• CWE-1333

• https://github.com/python/cpython/commit/34ddb64d088dd7ccc321f6103d23153256caa5d4Patch
• https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06Patch
• https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4Patch
• https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64dPatch
• https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877Patch
• https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbfPatch
• https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373Patch
• https://github.com/python/cpython/issues/121285Exploit, Issue Tracking, Patch
• https://github.com/python/cpython/pull/121286Issue Tracking, Patch
• https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/09/03/5Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
• https://security.netapp.com/advisory/ntap-20241018-0007/Third Party Advisory

Published

Sep 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6226The WpStickyBar WordPress plugin through 2.1.0 does not san…6.1
• CVE-2024-6227A vulnerability in aimhubio/aim version 3.19.3 allows an att…7.5
• CVE-2024-6228The Notifications for Forms & WordPress Actions WordPress pl…7.5
• CVE-2024-6229A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2024-6230The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does…6.5
• CVE-2024-6231The Request a Quote WordPress plugin before 2.4.1 does not s…5.9
• CVE-2024-6233Check Point ZoneAlarm Extreme Security Link Following Local …7.8
• CVE-2024-6235Sensitive information disclosure in NetScaler Console8.8
• CVE-2024-6236Denial of Service in NetScaler Console (formerly NetScaler…7.5
• CVE-2024-6237A flaw was found in the 389 Directory Server. This flaw allo…6.5
• CVE-2024-6238pgAdmin <= 8.8 has an installation Directory permission issu…5.3
• CVE-2024-6239A flaw was found in the Poppler's Pdfinfo utility. This issu…7.5