Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
References
| Link | Resource |
|---|---|
| https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628 | Patch |
| https://github.com/python-pillow/Pillow/pull/9521 | Issue Tracking Patch |
| https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j | Mitigation Patch Vendor Advisory |
| https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb | Release Notes |
Configurations
History
22 Apr 2026, 20:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628 - Patch | |
| References | () https://github.com/python-pillow/Pillow/pull/9521 - Issue Tracking, Patch | |
| References | () https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j - Mitigation, Patch, Vendor Advisory | |
| References | () https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb - Release Notes | |
| CPE | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Python
Python pillow |
15 Apr 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-15 23:16
Updated : 2026-04-22 20:08
NVD link : CVE-2026-40192
Mitre link : CVE-2026-40192
CVE.ORG link : CVE-2026-40192
JSON object : View
Products Affected
python
- pillow