CVE-2026-82049
Fixed in a distro release EPSS <1%CVSS 8.4
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.
Products: Python Software Foundation CPython
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.21 | python3 | 3.12.15-r0 |
| Alpine 3.22 | python3 | 3.12.15-r0 |
| Alpine 3.23 | python3 | 3.12.15-r0 |
| Alpine 3.24 | python3 | 3.14.8-r0 |
| Chainguard | python-3.10 | 3.10.22-r1 |
| Chainguard | python-3.11 | 3.11.17-r1 |
| Chainguard | python-3.12 | 3.12.15-r0 |
| Chainguard | python-3.13 | 3.13.15_git20260912-r0 |
| Debian 13 | pypy3 | no fix |
| Debian 13 | python3.13 | no fix |
| Debian 14 | pypy3 | no fix |
| Debian 14 | python3.13 | no fix |
| Red Hat hummingbird 1 | python-unversioned-command | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3 | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3-debug | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3-devel | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3-idle | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3-libs | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3-test | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3-tkinter | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.10 | 0:3.10.21-1.3.hum1 |
| Red Hat hummingbird 1 | python3.10-debug | 0:3.10.21-1.3.hum1 |
| Red Hat hummingbird 1 | python3.10-devel | 0:3.10.21-1.3.hum1 |
| Red Hat hummingbird 1 | python3.10-idle | 0:3.10.21-1.3.hum1 |
| Red Hat hummingbird 1 | python3.10-libs | 0:3.10.21-1.3.hum1 |
| Red Hat hummingbird 1 | python3.10-test | 0:3.10.21-1.3.hum1 |
| Red Hat hummingbird 1 | python3.10-tkinter | 0:3.10.21-1.3.hum1 |
| Red Hat hummingbird 1 | python3.11 | 0:3.11.16-1.4.hum1 |
| Red Hat hummingbird 1 | python3.11-debug | 0:3.11.16-1.4.hum1 |
| Red Hat hummingbird 1 | python3.11-devel | 0:3.11.16-1.4.hum1 |
| Red Hat hummingbird 1 | python3.11-idle | 0:3.11.16-1.4.hum1 |
| Red Hat hummingbird 1 | python3.11-libs | 0:3.11.16-1.4.hum1 |
| Red Hat hummingbird 1 | python3.11-test | 0:3.11.16-1.4.hum1 |
| Red Hat hummingbird 1 | python3.11-tkinter | 0:3.11.16-1.4.hum1 |
| Red Hat hummingbird 1 | python3.12 | 0:3.12.14-1.3.hum1 |
| Red Hat hummingbird 1 | python3.12-debug | 0:3.12.14-1.3.hum1 |
| Red Hat hummingbird 1 | python3.12-devel | 0:3.12.14-1.3.hum1 |
| Red Hat hummingbird 1 | python3.12-idle | 0:3.12.14-1.3.hum1 |
| Red Hat hummingbird 1 | python3.12-libs | 0:3.12.14-1.3.hum1 |
| Red Hat hummingbird 1 | python3.12-test | 0:3.12.14-1.3.hum1 |
| Red Hat hummingbird 1 | python3.12-tkinter | 0:3.12.14-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13 | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-debug | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-devel | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-freethreading | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-freethreading-debug | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-idle | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-libs | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-test | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.13-tkinter | 0:3.13.15-1.3.hum1 |
| Red Hat hummingbird 1 | python3.14 | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.14-freethreading | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.14-freethreading-debug | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.14-freethreading-devel | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.14-freethreading-idle | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.14-freethreading-libs | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.14-freethreading-test | 0:3.14.7-1.1.hum1 |
| Red Hat hummingbird 1 | python3.14-freethreading-tkinter | 0:3.14.7-1.1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python310 | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python310-core | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python310 | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python310-core | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Micro 5.3 | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Micro 5.3 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Micro 5.4 | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Micro 5.4 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Micro 5.5 | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Micro 5.5 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python | 2.7.18-150000.136.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python-base | 2.7.18-150000.136.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | python3 | 3.4.10-25.199.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | python3-base | 3.4.10-25.199.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | python36 | 3.6.15-125.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | python36-core | 3.6.15-125.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python310 | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python310-core | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python312 | 3.12.15-150600.3.71.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python312-core | 3.12.15-150600.3.71.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | python3 | 3.4.10-25.199.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | python3-base | 3.4.10-25.199.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | python36 | 3.6.15-125.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | python36-core | 3.6.15-125.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python310 | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python310-core | 3.10.22-150400.4.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python311 | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python311-core | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python311-documentation | 3.11.17-150400.9.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python3 | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python3-core | 3.6.15-150300.10.129.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python312 | 3.12.15-150600.3.71.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python312-core | 3.12.15-150600.3.71.1 |
| Ubuntu 20.04 LTS | pypy3 | no fix |
| Ubuntu 22.04 LTS | pypy3 | no fix |
| Ubuntu 22.04 LTS | python3.10 | no fix |
| Ubuntu 24.04 LTS | pypy3 | no fix |
| Ubuntu 24.04 LTS | python3.12 | no fix |
| Ubuntu 26.04 LTS | pypy3 | no fix |
| Ubuntu 26.04 LTS | python3.14 | no fix |
| Ubuntu 26.10 | pypy3 | no fix |
| Ubuntu 26.10 | python3.14 | no fix |
| Ubuntu Pro 14.04 LTS | python2.7 | no fix |
| Ubuntu Pro 14.04 LTS | python3.4 | no fix |
| Ubuntu Pro 14.04 LTS | python3.5 | no fix |
| Ubuntu Pro 16.04 LTS | python2.7 | no fix |
| Ubuntu Pro 16.04 LTS | python3.5 | no fix |
| Ubuntu Pro 18.04 LTS | python2.7 | no fix |
| Ubuntu Pro 18.04 LTS | python3.6 | no fix |
| Ubuntu Pro 18.04 LTS | python3.7 | no fix |
| Ubuntu Pro 18.04 LTS | python3.8 | no fix |
| Ubuntu Pro 20.04 LTS | python2.7 | no fix |
| Ubuntu Pro 20.04 LTS | python3.8 | no fix |
| Ubuntu Pro 20.04 LTS | python3.9 | no fix |
| Ubuntu Pro 22.04 LTS | python2.7 | no fix |
| Ubuntu Pro 22.04 LTS | python3.11 | no fix |
| Wolfi | python-3.10 | 3.10.22-r1 |
| Wolfi | python-3.11 | 3.11.17-r1 |
| Wolfi | python-3.12 | 3.12.15-r0 |
| Wolfi | python-3.13 | 3.13.15_git20260912-r0 |
| openSUSE Tumbleweed | python310 | 3.10.22-1.1 |
| openSUSE Tumbleweed | python311 | 3.11.17-1.1 |
| openSUSE Tumbleweed | python312 | 3.12.15-1.1 |
| openSUSE Tumbleweed | python313 | 3.13.16-1.1 |
| openSUSE Tumbleweed | python315 | 3.15.0~rc3-1.1 |