Pillow: TarIO negative size field causes infinite CPU-spin loop
影響: pip:Pillow < 13.0.0 → 13.0.0
TarIO.__init__ does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.__init__ reads 512-byte tar headers one at a time, looking for a member with a given name. For each header it reads the size field and skips ahead to the next header: python size = int(s[124:135], 8) ... self.fh.seek((size + 511) & (~511), io.SEEK_CUR) There is no check…
| CVE | CVE-2026-96642 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 23. 오전 05:09 |
| 데이터 | Markdown JSON |
2026. 10. 23. 오전 01:01, GitHub Advisory Database에서 "Pillow: TarIO negative size field causes infinite CPU-spin loop"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-96642.