---
schema_version: '1.0'
id: security-20260711-96bbde
url: https://osv.dev/vulnerability/GHSA-r73j-pqj5-w3x7
url_hash: 96bbde67317dc65ffa11b0683bf145e1df26c44ca2152c6bcd0a93c321fa6e36
canonical_url: https://osv.dev/vulnerability/GHSA-r73j-pqj5-w3x7
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-42310
- GHSA-r73j-pqj5-w3x7
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- pillow
- PyPI
lang: en
published_at: '2026-05-04T20:19:30Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:54Z'
status: published
content_hash: 14f2732cdf744d8b47031c6e6ed3e65596241ffd28cc42ee3ad72daea01cc835
license_note: full
summary: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
summary_source: rss
summary_en: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
entities:
- name: HashTag
  type: concept
- name: https://deploymentsafety.openai.com/gpt-5-6/gpt-5-6.pdf
  type: artifact
key_facts: []
related: []
related_auto:
- name: SustainableQuantumComputing
  type: concept
  weight: 3.0
title: 'CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)'
---

# CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

## TL;DR
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

## Key Points
- cve / CVE-2026-42310 / GHSA-r73j-pqj5-w3x7 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H / pillow / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
**Advisory:** GHSA-r73j-pqj5-w3x7 (CVE-2026-42310)

**Affected (your watchlist):**
- `PyPI:pillow` 12.1.1 → fixed in 12.2.0 [docker/docker-llmwiki]

**Details:**
### Impact
An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

### Patches
Patched version: 12.2.0.

PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a
trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a
longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an
error if a cycle is detected.

### Workarounds
Use any version but the affected versions: >= 4.2.0, < 12.2.0

### Resources
 - Fix: https://github.com/python-pillow/Pillow/pull/9519

**References:**
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7
- https://nvd.nist.gov/vuln/detail/CVE-2026-42310
- https://github.com/python-pillow/Pillow/pull/9519
- https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-r73j-pqj5-w3x7_

## Source
元記事: [CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)](https://osv.dev/vulnerability/GHSA-r73j-pqj5-w3x7) — published 2026-05-04T20:19:30Z