{"metadata": {"vulnerability": "CVE-2026-96642", "count": 10, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-09-23T14:35:50.130Z", "date_only": false, "value": "2026-09-23T14:35:50.130Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96642", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T20:49:56.989Z", "date_only": false, "value": "2026-10-21T20:49:56.989Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96642", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-21T20:49:56.989Z", "date_only": false, "value": "2026-10-21T20:49:56.989Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96642", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T20:49:56.989Z", "date_only": false, "value": "2026-10-21T20:49:56.989Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-96642", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T20:58:58.969Z", "date_only": false, "value": "2026-10-21T20:58:58.969790Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117480904362332633", "record": "CVE-2026-96642", "field": "creation_timestamp", "uuid": "2bed0845-f224-4214-a04c-ab8f085d8edf", "content": "CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-96642https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7https://github.com/python-pillow/Pillow/pull/10012https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71dhttps://github.com/python-pillow/Pillow/releases/tag/13.0.0#python-pillow #Pillow#CVE_2026_96642#bot", "url": "https://infosec.exchange/users/cve/statuses/117480904362332633"}, {"timestamp": "2026-10-21T21:20:32Z", "date_only": false, "value": "2026-10-21T21:20:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3J72-P6QG-6XP7", "record": "GHSA-3J72-P6QG-6XP7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-21T21:20:32.650Z", "date_only": false, "value": "2026-10-21T21:20:32.650", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96642", "record": "FKIE_CVE-2026-96642", "field": "published"}, {"timestamp": "2026-10-22T16:01:46Z", "date_only": false, "value": "2026-10-22T16:01:46Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3J72-P6QG-6XP7", "record": "GHSA-3J72-P6QG-6XP7", "field": "published"}, {"timestamp": "2026-10-22T16:01:47Z", "date_only": false, "value": "2026-10-22T16:01:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3J72-P6QG-6XP7", "record": "GHSA-3J72-P6QG-6XP7", "field": "modified"}, {"timestamp": "2026-10-22T16:46:48.920Z", "date_only": false, "value": "2026-10-22T16:46:48.920", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96642", "record": "FKIE_CVE-2026-96642", "field": "lastModified"}]}