Skip to main content
CVE-2024-6232VulnerabilityPublished Updated

SUSE · security update for python3.9

Affects SUSESource GCVE Database

0
Authoritative record:CVE-2024-6232· High 7.5

Not known to be exploited · CVSS 7.5 High.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score
7.5High
How severe the flaw is on the 0–10 CVSS scale.
EPSS
2.2% chance of exploitation in 30 days – higher than 82% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 3 Sep 2024

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Affected software

ProductAffectedFixed in
PyPIcpythonpkg:pypi/cpythonOther threatsAffected
  • =0
  • =3.9.0
  • =3.10.0
  • =3.11.0
  • =3.12.0
  • =3.13.0
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released updated python3 packages that fix this vulnerability. Users should apply the security update as described in the Red Hat advisory RHSA-2025:1750. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are required beyond applying the official patch.

Description

A moderate severity Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2024-6232) exists in the Python 3 tarfile module used in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issue arises from excessive backtracking while parsing header values in the tarfile module. Red Hat has released updated python3 packages to address this vulnerability.

References

Community reviews

Loading reviews…