CVE-2024-8088

Infinite loop when iterating over zip archive entry names from zipfile.Path

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

We have discovered 281 live websites that are affected by CVE-2024-8088.

Run a Free Instant Scan



Affected Software

Product  CPython
Category Programming Languages
Vulnerable Domains281 live websites (72% of CPython install base)
Vulnerable Versions
  • from 0 through 3.8.20
  • from 3.9 through 3.9.20
  • from 3.10 through 3.10.15
  • from 3.11 through 3.11.10
  • from 3.12 through 3.12.6
Vulnerable Versions Count39 versions ( 60% of all versions)


Common Weakness Enumeration

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')



Details

  • Published - Aug 22, 2024
  • Updated - Nov 3, 2025

Credits

  • Jason R. Coombs (remediation developer)
  • Seth Larson (coordinator)

Website Distribution by Country

Number of websites using CVE-2024-8088
United States81 websites


Germany32 websites
Singapore24 websites
India15 websites
China14 websites
France10 websites
Denmark9 websites
Italy8 websites
GB8 websites
Brazil6 websites

Website Distribution by TLD

Number of websites using CVE-2024-8088
.com100 websites
.org27 websites
.dk22 websites
.net16 websites
.de9 websites
.it5 websites
.co.uk5 websites
.pl5 websites
.at4 websites
.ch4 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-8088

Top websites that are affected by CVE-2024-8088. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.***.org Germany***,***
*****.org Germany***,***
*****.*****.de Germany***,***
********.***.***.gr Greece***,***
***.********.it Italy***,***
****.*****.br Brazil*,***,***
**********.*****.*******.edu United States*,***,***
**********.com Germany*,***,***
************.org United States*,***,***
***.***.ua Ukraine*,***,***
See full domain list

FAQ

CVE-2024-8088 is Loop with Unreachable Exit Condition ('Infinite Loop') in CPython
A total of 281 websites have been identified as vulnerable to CVE-2024-8088, based on global website indexing conducted by WebTechSurvey.
The CPython is affected by the CVE-2024-8088 vulnerability.
CPython versions up to 3.12.6 are vulnerable to CVE-2024-8088.
CVE-2024-8088 is resolved in version 3.12.6 of CPython.

References