The vulnerability in CPython's tarfile module arises from improper handling of tar archives containing negative offsets. The TarFile extraction and entry enumeration APIs do not error on these negative offsets, causing an infinite loop and deadlock during parsing. This defect is classified under CWE-835 (Loop with Unreachable Exit Condition). The affected versions explicitly include CPython 3.10.0, 3.11.0, 3.12.0, 3.13.0, 3.14.0, and 3.14.0a1. The CVSS v3.1 score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No official vendor patch is referenced, but a mitigation patch is available via a third-party gist.

Successful exploitation causes an infinite loop and deadlock in the tarfile module during parsing of malicious tar archives. This results in denial of service by making the process hang indefinitely. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

No official patch from the Python Software Foundation is currently referenced. A third-party mitigation patch is available and can be applied after importing the tarfile module as a temporary fix. Users should monitor the official Python advisories for an official fix. Until then, applying the provided patch mitigates the infinite loop condition.