{"id":"ghsa-ghsa-254f-3936-288h","seq":62395,"kind":"advisory","title":"Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","url":"https://github.com/advisories/GHSA-254f-3936-288h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-254f-3936-288h","summary":"影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0\nSummary PdfParser's get_value() can recurse without any limit and crash with an uncaught RecursionError. It is reachable through Image.save(im, fp= , format=\"PDF\", append=True) when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch. Details get_value() in src/PIL/PdfParser.py This is a clas…","severity":"medium","techs":["python","github"],"cves":["CVE-2026-112391"],"tags":["GHSA-254f-3936-288h","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T21:11:07.000Z","fetched_at":"2026-10-21T21:12:51.612Z"}