- CVE-2026-11972: break out of the block loop in tarfile._Stream.seek as soon as read() returns no data, so a member header declaring a huge size can no longer keep a stream-mode archive spinning until it is interrupted - CVE-2026-9669: latch the libbz2 error code in BZ2Decomp_decompress and raise ValueError on any later call, so a BZ2Decompressor cannot be re-entered after a decompression error and write outside its output buffer; the same error is latched on BZ2FileObject through the new Util_BzRead wrapper, so a BZ2File whose stream already errored re-reports that IOError on every later read instead of re-entering BZ2_bzDecompress