Mfazrinizar

The `PdfParser.linearize page tree()` function in `src/PIL/PdfParser.py` treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When the `Image.save()` function is used with `format="PDF"` and `append=True` to process a malformed PDF where `/Kids` arrays repeatedly reference the same child `/Pages` node, the library expands the shared subtree as distinct pages. This can lead to the creation of exponentially many page references, resulting in disproportionate CPU consumption.

An issue exists in the internal helper used to escape log token values. The software fails to neutralize Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can inject these characters into an attacker-controlled log token, such as a Basic auth username processed via the `remote-user` token. This allows for log forging, where Unicode-aware downstream log processing systems split a single request log into multiple logical records.