CyberRota Analysis
AI-GeneratedThe py7zr library, used for handling 7zip archives, is vulnerable to a denial-of-service condition due to its inability to track the total decompressed size during extraction. This flaw allows a specially crafted .7z file to consume excessive disk space or memory, potentially leading to system resource exhaustion. Users and developers utilizing versions prior to 1.1.3 should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3.