Duarte Santos

The `HeaderUtils::split()` function parses header values using a pattern where a token alternative matches whitespace followed by a lookbehind. When a sequence of whitespace is placed before a separator, the engine attempts to divide the whitespace among iterations in exponentially many ways. This occurs within `HeaderBag` when processing the `Cache-Control` header during Request construction, making any application handling HTTP requests reachable without authentication. A request with a specifically crafted header can cause high CPU consumption; for instance, 17 spaces in an 8 KB header can cost nearly one second of CPU time. When 18 or more spaces are used, `preg match all()` reaches the `pcre.backtrack limit`, causing `split()` to return an empty array and silently drop all header directives.

The issue is related to the incorrect management of code generation in the `eval()` function of the ImageMath module in the Pillow library when processing the `environment` parameter. This can allow a remote attacker to execute arbitrary code. The vulnerability is different from previous issues and can expose Python projects to risk.