The vulnerability in CPython's tarfile module arises when a file is opened in streaming mode (mode="r|"). The module fails to correctly detect or handle the EOF condition, leading to a potential infinite loop during archive parsing. This is classified under CWE-252 (Unchecked Return Value) and related weaknesses. The CVSS 4.0 base score is 8.2, indicating a high severity with network attack vector, low attack complexity, and no privileges or user interaction required. No official patch or remediation level has been provided yet by the Python Software Foundation.

An attacker could craft a tar archive that, when processed by the vulnerable tarfile module in streaming mode, causes the parsing process to enter an infinite loop. This could lead to denial of service by exhausting system resources or causing application hang. There is no indication of code execution or data corruption from the provided data.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid processing untrusted tar archives in streaming mode or implement external controls to limit resource consumption during tarfile processing.