CVE-2026-40192
EUVD-2026-2313015.04.2026, 23:16
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| python | pillow | 10.3.0 ≤ 𝑥 < 12.2.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:12.2.0-1.el8ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:12.2.0-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:12.2.0-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:12.2.0-1.el8pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:12.2.0-1.el9pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:12.2.0-1.el9pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | 0:12.2.0-1.el9pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | 0:12.2.0-1.el9pc ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AI Inference Server 3.3 | 1778244559 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AI Inference Server 3.3 | 1778244531 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AI Inference Server 3.3 | 1778274666 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AI Inference Server 3.3 | 1778244546 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AI Inference Server 3.4 | 1787151840 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1779761061 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1780102732 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778690639 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778677633 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778677632 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778677745 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778666122 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778677632 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778666124 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1780388133 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677779 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677692 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778262893 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677701 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677741 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677767 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1779123334 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778263128 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778782933 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677718 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677716 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778263054 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677734 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677667 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677717 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778677722 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782472374 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471606 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.1 | 1779822261 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1779811412 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.14 | 1779689392 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1780891395 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1779204086 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.17 | 1779922205 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1779811473 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
References