Skip to main content

Inefficient Algorithmic Complexity

CVE-2026-55206

High
8.7/10

Summary

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to version 1.1.3, `PackInfo._read()` in `archiveinfo.py` used an O(n^2) cumulative sum pattern for attacker-controlled `numstreams` values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during `SevenZipFile.init()` before extraction. This issue is fixed in version 1.1.3.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-407 - Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References

Advisory Timeline

  • Published