Introduction
Parsing a malicious tar archive can freeze your Python application. CVE-2025-8194 is a high-severity flaw in the Python tarfile module that lets attackers trigger an infinite loop and deadlock by supplying archives with negative offsets. Any application that uses tarfile to process untrusted tar files can be hit with denial of service. The vulnerability is rated CVSS 7.5 and affects a wide range of Python deployments.
Technical Information
CVE-2025-8194 exists because the tarfile module does not validate negative offsets in tar archive entries. When tarfile parses an archive, the TarInfo._block method processes entry offsets and sizes. If an attacker crafts an archive with a negative offset, the module enters an infinite loop or deadlock during parsing and consumes CPU and memory indefinitely. This is a classic resource exhaustion vulnerability (CWE-835).
The vulnerable code path runs when tarfile enumerates or extracts entries, and because nothing checks the offset, the loop never ends. An attacker can exploit this by submitting a malicious tar archive to any Python application that processes untrusted tar files through tarfile's extraction or enumeration APIs.
Patch Information
The fix makes the Python tarfile module check that every member offset in a tar archive is non-negative. This closes off problems that could arise from processing malformed or malicious tar files.
The module now checks the offset of each member as it reads the archive. If an offset is negative, it raises a ReadError and stops processing the archive, so a tar file with invalid offsets is rejected before it can cause trouble.
Here is the check:
if tarinfo.offset < 0: raise ReadError("invalid member offset")
The Python development team built this check into the module's processing routine. It adds a layer of protection against exploits that rely on negative offsets and makes tar handling safer for the applications that depend on tarfile.
Reference: Python cpython PR 137027
Affected Systems and Versions
The vulnerability affects all Python versions that include the tarfile module prior to the patch in PR 137027. The available materials do not list specific affected versions. Any Python application that uses tarfile to process untrusted tar archives is at risk.
Vendor Security History
Python is maintained by the Python Software Foundation and is one of the most widely used programming languages in the world, running web applications, data science, automation, and more. The tarfile module is a standard library component for handling tar archives, and it has been the subject of multiple security advisories, including path traversal and denial-of-service vulnerabilities (e.g., CVE-2025-4517, CVE-2025-4138). The vendor has generally shipped patches promptly, but the fact that tarfile keeps turning up in advisories shows how complex and risky archive handling is.
