CVE-2026-15310
Public on 2026-08-25
Modified on 2026-08-28
Description
When decompressing crafted zip files using the bzip/LZMA/Zstandard
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion.
compressions, Python could use an attacker-controlled size to
pre-allocate memory, possibly resulting in memory exhaustion.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | python | Not Affected | ||
| Amazon Linux 2 - Core | python3 | Pending Fix | ||
| Amazon Linux 2 - Python3 Extra | python3 | No Fix Planned | ||
| Amazon Linux 2023 | python3.11 | 2026-10-24 | ALAS2023-2026-3231 | Fixed |
| Amazon Linux 2023 | python3.12 | 2026-10-24 | ALAS2023-2026-3230 | Fixed |
| Amazon Linux 2023 | python3.13 | 2026-10-24 | ALAS2023-2026-3229 | Fixed |
| Amazon Linux 2023 | python3.14 | 2026-10-24 | ALAS2023-2026-3232 | Fixed |
| Amazon Linux 2027 Preview | python3.14 | 2026-10-26 | ALAS2027-2026-217 | Fixed |
| Amazon Linux 2023 | python3.9 | Pending Fix | ||
| Amazon Linux 2 - Python3.8 Extra | python38 | No Fix Planned |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |