ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-0361.json"