Loop with Unreachable Exit Condition ('Infinite Loop') Affecting py3-pytorch-cuda-13.0 package, versions <2.14.1-r2


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.57% (48th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-PY3PYTORCHCUDA130-21693741
  • published24 Oct 2026
  • disclosed19 Oct 2026

Introduced: 19 Oct 2026

NewCVE-2026-112406  (opens in a new tab)
CWE-835  (opens in a new tab)

How to fix?

Upgrade Chainguard py3-pytorch-cuda-13.0 to version 2.14.1-r2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream py3-pytorch-cuda-13.0 package and not the py3-pytorch-cuda-13.0 package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.

CVSS Base Scores

version 3.1