CVE-2026-9669: bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow

Synopsis

A stack-based buffer overflow exists in Python's bz2.BZ2Decompressor when an application catches a decompression error and reuses the same decompressor object with crafted input. The vulnerability is reachable over the network (AV:N) and requires no authentication, but exploiting it depends on a specific application-level error-retry pattern and favorable conditions (AC:H, AT:P). Successful exploitation crashes the affected process, causing a denial of service. Patched-image rebuilds at CPython versions 3.13.14, 3.14.6, and 3.15.0 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable decompression path is exposed over the network, meaning an attacker can deliver crafted bz2 input to a reachable service without requiring local access.

• AuthenticationNot required

  No account or credentials are needed; an unauthenticated attacker can supply malicious compressed data directly.

• Victim interactionNot required

  No user action is required; the vulnerable code path triggers automatically when the application processes attacker-supplied input.

• Attack complexityDetail

  Exploitation depends on both a specific application error-retry pattern and additional environmental preconditions (AT:P), making reliable exploitation non-trivial and condition-dependent.

Blast Radius

• Crashes the Python process that calls the reused BZ2Decompressor, causing a full service outage for that worker or process.
• Any in-flight requests being handled by the crashed process are dropped and their results are lost.
• If the process is part of a pool without automatic restart, continued availability of the service is disrupted until the process is manually or automatically restarted.