The vulnerability CVE-2026-11972 in CPython's tarfile module arises when a file is opened in streaming mode (mode="r|"). The module fails to correctly handle the end-of-file (EOF) condition, resulting in exponentially increased parsing time for archives. This flaw can be exploited to cause denial of service through excessive resource consumption. The issue is tracked under CWE-252 (Unchecked Return Value), with related CWEs indicating improper handling of exceptional conditions. The vulnerability is present in CPython versions before 3.16.0. There is no vendor advisory indicating an available patch or fix at this time.

This vulnerability can cause denial of service by making the tarfile module take exponentially longer to parse archives when used in streaming mode. This leads to resource exhaustion and potential application unavailability. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using the tarfile module in streaming mode (mode="r|") with untrusted or large archives to mitigate potential denial of service.