CVE-2026-15310

zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

We have discovered 455 live websites that are affected by CVE-2026-15310.

Run a Free Instant Scan



Affected Software

Product  CPython
Category Programming Languages
Vulnerable Domains455 live websites (100% of CPython install base)
Vulnerable Versions
  • from 0 through 3.15
Vulnerable Versions Count65 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-400 Uncontrolled Resource Consumption



Details

  • Published - Aug 25, 2026
  • Updated - Aug 26, 2026

Credits

  • tonghuaroot (童话) (https://github.com/tonghuaroot) (reporter)
  • Petr Viktorin (https://github.com/encukou) (coordinator)
  • William Woodruff (https://github.com/woodruffw) (remediation reviewer)

Website Distribution by Country

Number of websites using CVE-2026-15310
United States149 websites


Germany62 websites
Singapore28 websites
France22 websites
India19 websites
China13 websites
Russia12 websites
GB12 websites
Switzerland10 websites
Brazil9 websites

Website Distribution by TLD

Number of websites using CVE-2026-15310
.com164 websites
.org40 websites
.net23 websites
.dk23 websites
.de21 websites
.fr8 websites
.ch8 websites
.edu7 websites
.nl7 websites
.it6 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15310

Top websites that are affected by CVE-2026-15310. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.com United States**,***
*********.com Netherlands***,***
*******.***.org Germany***,***
****.***********.***.au Australia***,***
*************.com United States***,***
********.***.***.gr Greece***,***
***.********.it Italy***,***
***************.de Germany*,***,***
****.*****.br Brazil*,***,***
*********.com United States*,***,***
See full domain list

FAQ

CVE-2026-15310 is Uncontrolled Resource Consumption in CPython
A total of 455 websites have been identified as vulnerable to CVE-2026-15310, based on global website indexing conducted by WebTechSurvey.
The CPython is affected by the CVE-2026-15310 vulnerability.
CPython versions up to 3.15 are vulnerable to CVE-2026-15310.
CVE-2026-15310 is resolved in version 3.15 of CPython.