Skip to content
OpenAdvisories
High ALSA-2026:39127 4 CVEs

Important: python-pillow security update

Published Jul 14, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 8 python3-pillow 5.1.1-22.el8_10
AlmaLinux · 8 python3-pillow-devel 5.1.1-22.el8_10
AlmaLinux · 8 python3-pillow-doc 5.1.1-22.el8_10
AlmaLinux · 8 python3-pillow-tk 5.1.1-22.el8_10

Vulnerabilities 4

  • High 7.5
    CVE-2026-54059

    Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF fo…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-54060

    Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessi…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-55379

    Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing P…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2026-55380

    Pillow GdImageFile decompression bomb protection bypass

    Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger ex…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-54059
  • report
    https://access.redhat.com/security/cve/CVE-2026-54060
  • report
    https://access.redhat.com/security/cve/CVE-2026-55379
  • report
    https://access.redhat.com/security/cve/CVE-2026-55380
  • report
    https://bugzilla.redhat.com/2497452
  • report
    https://bugzilla.redhat.com/2497455
  • report
    https://bugzilla.redhat.com/2497464
  • report
    https://bugzilla.redhat.com/2497466
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-39127.html