Skip to content
OpenAdvisories
High · 8.7 CVE-2026-112895 BIT-pillow-2026-112895EUVD-2026-104657GHSA-p4wg-p73j-c528

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Published Oct 19, 2026 · Updated Oct 20, 2026 · Assigned by GitHub_M

Vendor: python-pillow Product: Pillow Package: gftools Package: kserve-storage-controller Package: kubeflow-pipelines-visualization-server Package: open-webui Package: pillow Package: pillow Package: pillow Package: pillow-python2 Package: py3.10-pillow Package: py3.11-pillow Package: py3.12-pillow Package: py3.13-pillow Package: superset-6.0 Package: superset-6.1 Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.

Affected products

VendorProductAffectedFixed
python-pillow Pillow >= 5.1.0, < 13.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 pillow No fix yet —
Debian 13 pillow No fix yet —
Debian 12 pillow No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pillow 12.3.0-1ubuntu2 USN-9064-1
Ubuntu 26.04 LTS pillow 12.1.1-2ubuntu1.5 USN-9064-1
Ubuntu 24.04 LTS pillow 10.2.0-1ubuntu1.5 USN-9064-1
Ubuntu 22.04 LTS pillow 9.0.1-1ubuntu0.7 USN-9064-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS pillow 7.0.0-4ubuntu0.9+esm2 USN-9064-1
Ubuntu Pro 20.04 LTS pillow-python2 No fix yet —
Ubuntu Pro 18.04 LTS pillow 5.1.0-1ubuntu0.8+esm3 USN-9064-1
Ubuntu Pro 16.04 LTS pillow 3.1.2-0ubuntu1.6+esm4 USN-9064-1
Ubuntu Pro 14.04 LTS pillow 2.3.0-1ubuntu3.4+esm6 USN-9064-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 python-pillow +4 5.1.1-33.el8_10 RHSA-2026:92639
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 TUS python-pillow +1 5.1.1-20.el8_8.2 RHSA-2026:98109
RHEL 8.8 E4S python-pillow +1 5.1.1-20.el8_8.2 RHSA-2026:98109
RHEL 8.6 EUS Long Life python-pillow +1 5.1.1-20.el8_6.2 RHSA-2026:98111
RHEL 8.6 AUS python-pillow +1 5.1.1-20.el8_6.2 RHSA-2026:98111
RHEL 8.4 EUS Long Life python-pillow +1 5.1.1-15.el8_4.3 RHSA-2026:98120
RHEL 8.4 AUS python-pillow +1 5.1.1-15.el8_4.3 RHSA-2026:98120

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 python3-pillow +3 5.1.1-33.el8_10 ALSA-2026:92639

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 python-pillow 5.1.1-33.el8_10 RLSA-2026:92639

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 python-Pillow 7.2.0-150300.3.33.1 SUSE-SU-2026:5038-1
SLES 15 SP6 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 15 SP5 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 15 SP4 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 3 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 python-Pillow 11.3.0-160000.9.1 SUSE-SU-2026:24656-1
SLES for SAP 15 SP6 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES for SAP 15 SP5 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES for SAP 15 SP4 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLES 16.0 python-Pillow 11.3.0-160000.9.1 SUSE-SU-2026:24656-1
SLE HPC 15 SP5 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1
SLE HPC 15 SP4 python-Pillow 9.5.0-150400.5.28.1 SUSE-SU-2026:5194-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 python-Pillow 11.3.0-160000.9.1 openSUSE-SU-2026:22246-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 python3-pillow +3 5.1.1-33.el8_10 ELSA-2026-92639

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling gftools 0.10.4-r1 —
Wolfi rolling kserve-storage-controller 0.21.0-r9 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.17.2-r7 —
Wolfi rolling open-webui 0.12.3-r6 —
Wolfi rolling py3.10-pillow No fix yet —
Wolfi rolling py3.11-pillow +2 13.0.0-r0 —
Wolfi rolling superset-6.0 6.0.0-r21 —
Wolfi rolling superset-6.1 6.1.0-r16 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pillow >= 5.1.0, < 13.0.0 13.0.0 GHSA-p4wg-p73j-c528

Advisories 13

References