Description
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| python-pillow | Pillow | >= 10.3.0, < 12.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 12.2.0-1 | — |
| Debian 13 | pillow | 11.1.0-5+deb13u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | pillow | 12.1.1-2ubuntu1.1 | — |
| Ubuntu 25.10 | pillow | 11.3.0-1ubuntu1.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.14.0.17-1.el9sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 1.6.3-1.1.el8sat | RHSA-2026:34366, RHSA-2026:27076 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.14.0.17-1.el9sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite Capsule 6 | python-pillow +1 | 12.2.0-1.el8pc | RHSA-2026:34366, RHSA-2026:27076 |
| Red Hat Satellite Capsule 6 | python3.12-pillow | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34365 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | candlepin +1 | 4.7.5-1.el9sat | RHSA-2026:34365 |
| Red Hat Satellite 6 | dynflow-utils | 1.6.3-1.1.el8sat | RHSA-2026:34366, RHSA-2026:27076 |
| Red Hat Satellite 6 | foreman +14 | 3.14.0.17-1.el9sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
| Red Hat Satellite 6 | python-pillow +1 | 12.2.0-1.el8pc | RHSA-2026:34366, RHSA-2026:27076 |
| Red Hat Satellite 6 | python3.12-pillow | 12.2.0-1.el9pc | RHSA-2026:34368, RHSA-2026:34365 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:34365 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-5.el8sat | RHSA-2026:34368, RHSA-2026:34366, RHSA-2026:34365 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.12-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.12-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.29-2.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | 2.6.14-3.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-6.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260422-3.el8ap | RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.9-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-pillow | 12.2.0-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.5-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | receptorctl | 1.6.5-1.el9ap | RHSA-2026:24762 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Pillow | 12.2.0-2.1 | openSUSE-SU-2026:10575-1 |
| openSUSE Leap 16.0 | python-Pillow | 11.3.0-160000.4.1 | openSUSE-SU-2026:20617-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.16.1-r1 | — |
| Wolfi rolling | open-webui | 0.8.12-r4 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | >= 10.3.0, < 12.2.0 | 12.2.0 | GHSA-whj4-6x5x-4v2j |
Advisories 11
- WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- WID-SEC-2026-2166 Red Hat Satellite (foreman, python-pillow, go): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:34366 Red Hat Security Advisory: Satellite 6.17.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34368 Red Hat Security Advisory: Satellite 6.18.7 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:34365 Red Hat Security Advisory: Satellite 6.19.2 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:27076 Red Hat Security Advisory: Satellite 6.16.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24761 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24762 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:20617-1 Security update for python-Pillow SUSE / openSUSE Security Updates · Apr 25, 2026
- openSUSE-SU-2026:10575-1 python311-Pillow-12.2.0-2.1 on GA media SUSE / openSUSE Security Updates · Apr 19, 2026
References
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
- https://github.com/python-pillow/Pillow/pull/9521
- https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
- https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb