CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None
CPython CVE-2026-87910: tarfile's hardlink fallback ignores custom extraction filters that reject entries via None, rated MEDIUM severity.
Petr Viktorin disclosed CVE-2026-87910 on the CPython security-announce list, rated MEDIUM severity. The flaw is in the tarfile module: when a custom extraction filter rejects an entry by returning None, the hardlink fallback path ignores the rejection. The posted excerpt did not include affected versions or patch details.
38