Skip to main content
CVE-2024-8088VulnerabilityPublished Updated

SUSE · security update for python3.9

Affects SUSESource GCVE Database

0
Authoritative record:CVE-2024-8088· High 8.7

Not known to be exploited · CVSS 8.7 High : upgrade the Red Hat redhat/python3.9 package to 9.5.0 soon.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 4.0 base score
8.7High
How severe the flaw is on the 0–10 CVSS scale.
EPSS
1.2% chance of exploitation in 30 days – higher than 69% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 9.5.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:N/AU:N/R:U/RE:L

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 22 Aug 2024

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade the Red Hat redhat/python3.9 package to 9.5.0.

Affected software

ProductAffectedFixed in
Red Hatredhat/python3.9pkg:rpm/redhat/python3.9Other threatsAffected
  • =9.0.0
  • <9.5.0
Fixed in
  • 9.5.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Official patches are available and should be applied to affected Python versions. Red Hat and Ubuntu have released updated python3 packages that fix this issue. Users should update to the patched versions as specified in vendor advisories. No additional mitigation is required beyond applying these updates.

Description

CVE-2024-8088 is a denial of service vulnerability in the CPython zipfile module's zipfile.Path API. It causes an infinite loop when iterating over entries in a maliciously crafted zip archive, impacting reading metadata or extracting contents. The more commonly used zipfile.ZipFile class is not affected. This vulnerability affects multiple Python versions prior to patched releases and is relevant when handling untrusted zip files. Official patches are available from vendors including Red Hat and Ubuntu.

References

Community reviews

Loading reviews…