GHSA-WHJ4-6X5X-4V2J FITS GZIP decompression bomb in Pillow

🗓️ 13 Apr 2026 19:22:35Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Pillow could read gzip data from FITS images, causing memory denial of service; fixed in 12.2.0.

Reporter	Title	Published	Views	Family All 106
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Pillow [CVE-2026-40192]	21 May 202615:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pillow-11.3.0 which is vulnerable to CVE-2026-40192	15 Jun 202610:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202610:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl which is vulnerable to CVE-2026-40192	29 May 202610:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Pillow package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage	6 Jul 202614:55	–	ibm
ATTACKERKB	CVE-2026-40192	15 Apr 202622:53	–	attackerkb
BDU FSTEC	The vulnerability of the Pillow image processing library, related to unlimited resource distribution, allows a hacker to cause a service failure.	20 Apr 202600:00	–	bdu_fstec
Chainguard	CVE-2026-40192 vulnerabilities	17 Apr 202607:18	–	cgr
Circl	CVE-2026-40192	16 Apr 202600:48	–	circl

Source	Link
github	www.github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-40192
github	www.github.com/python-pillow/Pillow/pull/9521
github	www.github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
github	www.github.com/python-pillow/Pillow
pillow	www.pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

13 Jul 2026 07:26Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.00671