UpHeron
All vulnerabilities

Servers and applications

CVE-2025-13462

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Severity
Low 2.0
Published
12 Mar 2026
Last changed
13 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.13.13, 3.14.4
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • Version 3.15.0-alpha7
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha4
All 9 release lines
  • Every version before 3.13.13
  • From 3.14.0 before 3.14.4
  • Version 3.15.0-alpha1
  • Version 3.15.0-alpha2
  • Version 3.15.0-alpha3
  • Version 3.15.0-alpha4
  • Version 3.15.0-alpha5
  • Version 3.15.0-alpha6
  • Version 3.15.0-alpha7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-13462
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13462