p PatchFirst

CVE-2026-40192

CVE-2026-40192 · Pillow is vulnerable to a FITS GZIP decompression bomb

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pillow

    Versions
    • >= 10.3.0, < 12.2.0: Affected

    No fix published

  • pillow Debian:13

    Versions
    • 11.1.0-5
    • 11.1.0-5+deb13u1
    Affected ranges
    • ECOSYSTEM: < 11.1.0-5+deb13u2

    Update to 11.1.0-5+deb13u2

  • pillow Debian:14

    Versions
    • 11.1.0-5
    • 11.2.1-1
    • 11.3.0-1
    • 12.0.0-1
    • 12.1.0-1
    • 12.1.1-1
    • 12.1.1-2
    Affected ranges
    • ECOSYSTEM: < 12.2.0-1

    Update to 12.2.0-1

  • pillow PyPI

    Versions
    • 10.3.0
    • 10.4.0
    • 11.0.0
    • 11.1.0
    • 11.2.1
    • 11.3.0
    • 12.0.0
    • 12.1.0
    • 12.1.1
    Affected ranges
    • ECOSYSTEM: ≥ 10.3.0, < 12.2.0

    Update to 12.2.0

  • pillow Ubuntu:25.10

    Versions
    • 11.1.0-5build1
    • 11.3.0-1ubuntu1
    • 11.3.0-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 11.3.0-1ubuntu1.2

    Update to 11.3.0-1ubuntu1.2

  • pillow Ubuntu:26.04:LTS

    Versions
    • 11.3.0-1ubuntu1
    • 11.3.0-1ubuntu2
    • 12.0.0-1ubuntu1
    • 12.1.1-1ubuntu1
    • 12.1.1-2ubuntu1
    Affected ranges
    • ECOSYSTEM: < 12.1.1-2ubuntu1.1

    Update to 12.1.1-2ubuntu1.1

Original sources

Check your server →