---
schema_version: '1.0'
id: security-20260714-3d3887
url: https://osv.dev/vulnerability/PYSEC-2026-2874
url_hash: 3d3887263a4d6d84f52fe48a114019c64e7fb97ff4655b3431b9e7d4b097b58b
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-2874
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-42310
- PYSEC-2026-2874
- severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- pillow
- PyPI
lang: en
published_at: '2026-07-13T15:02:57Z'
fetched_at: '2026-07-14T06:42:23Z'
updated_at: '2026-07-14T06:44:25Z'
status: published
content_hash: 04ccb3841fd86a341607db9206c685dd132dc82efcd2838e11790cd3aa129390
license_note: full
summary: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
summary_source: rss
summary_en: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
entities:
- name: Pillow
  type: artifact
- name: HashMark
  type: other
- name: https://deploymentsafety.openai.com/gpt-5-6/gpt-5-6.pdf
  type: artifact
key_facts: []
related: []
related_auto:
- name: 井案
  type: UNKNOWN
  weight: 1.0
title: 'CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)'
---

# CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

## TL;DR
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

## Key Points
- cve / CVE-2026-42310 / PYSEC-2026-2874 / severity:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H / pillow / PyPI

## Details
**Severity:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-2874 (CVE-2026-42310)

**Affected (your watchlist):**
- `PyPI:pillow` 12.1.1 → fixed in 12.2.0 [docker/docker-llmwiki]

**Details:**
### Impact
An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

### Patches
Patched version: 12.2.0.

PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a
trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a
longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an
error if a cycle is detected.

### Workarounds
Use any version but the affected versions: >= 4.2.0, < 12.2.0

### Resources
 - Fix: https://github.com/python-pillow/Pillow/pull/9519

**References:**
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7
- https://nvd.nist.gov/vuln/detail/CVE-2026-42310
- https://github.com/python-pillow/Pillow/pull/9519
- https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468
- https://github.com/python-pillow/Pillow
- https://github.com/python-pillow/Pillow/releases/tag/12.2.0
- https://pypi.org/project/pillow
- https://github.com/advisories/GHSA-r73j-pqj5-w3x7

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-2874_

## Source
元記事: [CVE-2026-42310: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)](https://osv.dev/vulnerability/PYSEC-2026-2874) — published 2026-07-13T15:02:57Z