Infinite loop in sharpcompress - #VU162736
Published: November 9, 2026
Vulnerability identifier: #VU162736
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to deny service to applications that automatically decompress untrusted archives with SharpCompress.
The vulnerability exists due to improper end-of-stream handling in the LZMA2 decoder when truncated XZ streams or crafted 7z archives end at a chunk boundary before the next control byte. An unauthenticated remote attacker can submit these inputs concurrently to trigger infinite decoding loops that exhaust CPU cores and make the application unavailable.
Affected software
sharpcompress
Remediation
Install security update from vendor's website.
sharpcompress - update to 0.50.6