{"id":"ghsa-ghsa-mrfp-p49p-3hf2","seq":309592,"kind":"advisory","title":"Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion","url":"https://github.com/advisories/GHSA-mrfp-p49p-3hf2","permalink":"https://vulnpulse.app/items/ghsa-ghsa-mrfp-p49p-3hf2","summary":"影響: pip:Pillow >= 5.1.0, < 13.0.0 → 13.0.0\nPillow's documented PDF append path can spend disproportionate CPU time on a compact malformed PDF page tree. An attacker who can supply an existing PDF to an application that appends an image with Image.save(..., format=\"PDF\", append=True) can provide a malformed /Pages tree where each level repeats the same child /Pages reference in /Kids. Pillow treats the graph as a tree and expands each repeated reference in PdfParser.linearize_page_tree() without tracking visited or duplicate indirect ref…","severity":"high","techs":["python"],"cves":["CVE-2026-96640"],"tags":["GHSA-mrfp-p49p-3hf2","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:00:47.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}