TencentOS Server 3: python-pillow (TSSA-2026:1434)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1434 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-123463

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get value can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

EUVD-2026-104601

Pillow: PdfParser can recurse without limit in getvalue and linearizepagetree...

SUSE CVE-2026-112391

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

Linux Distros Unpatched Vulnerability : CVE-2026-112391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parse...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via unbounded recursion in PdfParser.getvalue and PdfParser.readindirect in src/PIL/PdfParser.py. Both functions previously defaulted maxnesting to -1, meaning no nesting limit was enforced when parsing PDF structures. An...

DEBIAN-CVE-2026-112391

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

CVE-2026-112391

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

CVE-2026-112391

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

CVE-2026-112391

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

PT-2026-117646

Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description The PdfParser.get value function can recurse without a limit when reading nested PDF objects. This occurs when the parser follows attacker-controlled arrays and dictionaries while an existing P...

CVE-2026-112391: Loop with Unreachable Exit Condition

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

Pillow Resource Management Error Vulnerability

Pillow versions 5.1.0 to 13.0.0 have a resource management vulnerability. This vulnerability stems from PdfParser.getvalue, which recurses indefinitely when reading nested PDF objects. The parser follows the array and dictionary controlled by the attacker when adding existing PDFs to the process...