{"id":"ghsa-ghsa-3j72-p6qg-6xp7","seq":309590,"kind":"advisory","title":"Pillow: TarIO negative size field causes infinite CPU-spin loop","url":"https://github.com/advisories/GHSA-3j72-p6qg-6xp7","permalink":"https://vulnpulse.app/items/ghsa-ghsa-3j72-p6qg-6xp7","summary":"影響: pip:Pillow < 13.0.0 → 13.0.0\nTarIO.__init__ does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.__init__ reads 512-byte tar headers one at a time, looking for a member with a given name. For each header it reads the size field and skips ahead to the next header: python size = int(s[124:135], 8) ... self.fh.seek((size + 511) & (~511), io.SEEK_CUR) There is no check…","severity":"high","techs":["python"],"cves":["CVE-2026-96642"],"tags":["GHSA-3j72-p6qg-6xp7","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:01:46.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}