Threats tagged 'brew-aider-cve-2026-96642'

The Pillow library's TarIO class has a vulnerability where it does not validate that a tar header's size field is non-negative. A crafted tar file with a negative size field causes the TarIO class to enter an infinite CPU-spin loop, consuming 100% CPU and never returning. This issue affects applications that directly use TarIO.TarIO() to read tar archives, but not the common Image.open() path in Pillow.