Junglewise Threat Intelligence

CVE-2026-40192: Python Pillow denial of service via FITS GZIP decompression bomb

CVE-2026-40192 · Severity: high · CVSS 7.5 · Published 2026-04-15

Technologies: pillow (PyPI). Vendors: PyPI.

Executive brief

Pillow, a widely used Python library for image processing, is vulnerable to 'decompression bomb' attacks when handling FITS images. An attacker can provide a specially crafted image file that, when opened, consumes an excessive amount of system memory. This can lead to the application crashing or the entire server becoming unresponsive, disrupting business operations.

Technical details

A resource exhaustion vulnerability (CWE-400) exists in Pillow's FitsImagePlugin.py. The library failed to limit the amount of GZIP-compressed data read during the decoding of Flexible Image Transport System (FITS) images. An attacker can exploit this by providing a small, highly compressed FITS file that expands to a massive size in memory upon decompression. This results in an Out-Of-Memory (OOM) condition or severe performance degradation. The issue was introduced in version 10.3.0 and is fixed in version 12.2.0 by ensuring only the necessary amount of data is read from the decompressor.

Affected products

  • Python-Pillow Pillow >= 10.3.0, < 12.2.0

Timeline

  • 2026-03-31: patched: Fix merged into main branch via PR #9521
  • 2026-04-01: advisory: Release notes for version 12.2.0 published
  • 2026-04-10: disclosed: GitHub Security Advisory GHSA-whj4-6x5x-4v2j published
  • 2026-04-15: disclosed: NVD publication date

References

Related threats