{"id":"ghsa-ghsa-p4wg-p73j-c528","seq":2384,"kind":"advisory","title":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","url":"https://github.com/advisories/GHSA-p4wg-p73j-c528","permalink":"https://vulnpulse.app/items/ghsa-ghsa-p4wg-p73j-c528","summary":"影響: pip:pillow >= 5.1.0, < 13.0.0 → 13.0.0\nSummary When an application appends to an existing PDF with Image.save(..., format=\"PDF\", append=True), Pillow parses that file with PdfParser. Two recursive parsers have no effective bound. linearize_page_tree follows /Kids with no visited set or depth limit, so a cyclic or duplicated page tree recurses without end. read_prev_trailer rejects only an exactly repeated /Prev offset, so a long chain of unique offsets still recurses. The trailer-loop guard added for CVE-2026-42310 does not cover ei…","severity":"high","techs":["python"],"cves":["CVE-2026-112895"],"tags":["GHSA-p4wg-p73j-c528","pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T20:50:49.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}