Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-F2G6-542V-9J58 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

============================================================================ Infinite loop in PdfParser.rewritepages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewritepages Commit: a707c6b21c313880d0771e54965d142dd42358b6...

CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-112406

The Pillow Python imaging library (versions 5.1.0 through 13.0.0 ) contains a vulnerability where PdfParser.rewrite_pages() can enter an infinite loop . The root cause is that the function follows Parent relationships in a page tree without detecting cycles. An attacker can provide a cyclic PDF t...

PYSEC-2026-4121 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

SummaryAny authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

CVE-2026-52852 Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...

EUVD-2026-75172

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle...

GHSA-8R35-5X5R-HV74 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

CVE-2026-87013

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

CVE-2026-87013 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

CVE-2026-87013 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

CVE-2026-87013

Open WebUI versions 0.10.0 through 0.11.1 contain a denial-of-service vulnerability in the folder tree functionality. The POST /api/v1/folders/{id}/update/parent endpoint allowed an authenticated user to place a folder under itself or one of its descendants, creating a parent cycle . Because the ...

CVE-2026-87013 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

PT-2026-89160

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An authenticated user can create a parent cycle by placing a folder under itself or one of its descendants. This occurs because the system does not validate that the new parent is not the...