CVE-2026-96642: Pillow: TarIO negative size field causes infinite CPU-spin loop
TarIO.__init__ does not check that a tar header’s size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns.
References
- github.com/advisories/GHSA-3j72-p6qg-6xp7
- github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d
- github.com/python-pillow/Pillow/pull/10012
- github.com/python-pillow/Pillow/releases/tag/13.0.0
- github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7
- nvd.nist.gov/vuln/detail/CVE-2026-96642
Code Behaviors & Features
Detect and mitigate CVE-2026-96642 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →