PYSEC-2026-2250
At a glance
- Published
- Updated
- CVE
- CVE-2026-40192
- Aliases
- BIT-pillow-2026-40192, GHSA-whj4-6x5x-4v2j
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pillow | introduced 10.3.0, fixed 12.2.0 |
References
- https://access.redhat.com/security/cve/CVE-2026-40192 WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json WEB
- https://access.redhat.com/errata/RHSA-2026:16008 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:16009 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:16030 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:16174 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:17609 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:17611 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:19375 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:19712 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:21017 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:22465 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:22629 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:22840 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:23361 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:24761 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:24762 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:24853 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:24866 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:24977 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:27076 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:34365 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:34366 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:34368 ADVISORY
- https://access.redhat.com/errata/RHSA-2026:37275 ADVISORY
- https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2458856 REPORT
- https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628 FIX
- https://github.com/python-pillow/Pillow/pull/9521 FIX
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |