The vulnerability exists in the Python Software Foundation's CPython implementation, specifically in the tarfile module when a file is opened in streaming mode (mode="r|"). The module fails to correctly handle the end-of-file (EOF) condition, resulting in exponential delays during archive parsing. This flaw is categorized under CWE-252 (Unchecked Return Value) and related weaknesses. The CVSS 4.0 score is 8.2, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

The improper EOF handling causes the tarfile module to take exponentially longer to parse archives in streaming mode, potentially leading to denial of service through resource exhaustion or significant performance degradation in applications relying on tarfile for archive processing.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, users should avoid using the tarfile module in streaming mode with untrusted archives or implement additional timeout or resource usage limits in their applications to mitigate potential performance impacts.