FITS GZIP decompression bomb in Pillow

🗓️ 13 Apr 2026 19:22:35Reported by GitHub Advisory DatabaseType

Pillow did not limit GZIP data when decoding FITS, risking memory DoS; fixed in 12.2.0.

Reporter	Title	Published	Views	Family All 112
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Pillow [CVE-2026-40192]	21 May 202615:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pillow-11.3.0 which is vulnerable to CVE-2026-40192	15 Jun 202610:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow containers July 2026	5 Aug 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202610:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.	5 Aug 202607:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-40192	29 May 202610:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillow package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage	6 Jul 202614:55	–	ibm
ATTACKERKB	CVE-2026-40192	15 Apr 202622:53	–	attackerkb
BDU FSTEC	The vulnerability of the Pillow image processing library, related to unlimited resource distribution, allows a hacker to cause a service failure.	20 Apr 202600:00	–	bdu_fstec

Vulners

Node

python pillowRange10.3.0–12.2.0pip

Source	Link
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
github	www.github.com/python-pillow/Pillow/pull/9521
github	www.github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-40192
github	www.github.com/advisories/GHSA-whj4-6x5x-4v2j

27 Apr 2026 16:21Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.00671

SSVC