[Security-announce][CVE-2026-11972] tarfile opened in streaming mode mishandles EOF

There is a MEDIUM severity vulnerability affecting CPython.

When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.

Please see the linked CVE ID for the latest information on affected versions:

• https://www.cve.org/CVERecord?id=CVE-2026-11972
• https://github.com/python/cpython/pull/151982