Threats tagged 'brew-aider-cve-2026-112895'

Pillow's PDF parser has unbounded recursion vulnerabilities when appending to existing PDFs using Image.save with append=True. The recursive functions linearize_page_tree and read_prev_trailer do not effectively prevent cycles or long chains, leading to infinite recursion or excessive CPU and memory consumption. This is a follow-up to CVE-2026-42310 and affects versions from 0.86.1_1 onward. The issue can cause denial of service by exhausting resources during PDF parsing.