OESA-2026-3139 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0,...

OESA-2026-3140 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0,...

PYSEC-2026-3495 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...

OPENSUSE-SU-2026:21430-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE-SU-2026:22863-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

SUSE-SU-2026:22937-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue - CVE-2026-9375: decompression bomb bypass in the streaming API when using Brotli support can lead to a denial of service bsc1268683...

nginx security update

1.26.3-6.0.1.el102.5 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-6.5 - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer...

GHSA-JJJ6-MW9F-P565 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...

node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

EUVD-2026-42305

node-tar: Decompression/parse DoS via unlimited input...

GHSA-PHJ9-MV4W-65PM Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Description PIL/GdImageFile.py GdImageFile.open reads image dimensions from the GD 2.x header and stores them in self.size without calling Image.decompressionbombcheck. Because GdImageFile is not registered with Image.registeropen, it never passes through the standard Image.open code path that...

EUVD-2026-41901

Pillow GdImageFile.open: image dimensions accepted without decompressionbombcheck...

EUVD-2026-41902

Pillow BdfFontFile: Image.new called without decompressionbombcheck — bomb protection bypass via font loading...

GHSA-45HQ-CXWH-F6VC Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Summary PIL/BdfFontFile.py bdfchar lines 84–88 reads the BBX width height field from a BDF font file and passes the dimensions directly to Image.new without calling Image.decompressionbombcheck. This completely bypasses Pillow's documented decompression bomb protection. Image.open enforces...

GHSA-5X94-69RX-G8H2 Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Description PIL/FontFile.py FontFile.compile assembles per-glyph images into a single combined bitmap using Image.new"1", xsize, ysize without calling Image.decompressionbombcheck. This is the base-class method shared by both BdfFontFile and PcfFontFile, and it is triggered whenever a loaded font...

EUVD-2026-41900

Pillow: FontFile.compile: Image.new called without decompressionbombcheck...

EUVD-2026-41899

Pillow PcfFontFile.loadbitmaps: Image.frombytes called without decompressionbombcheck — bomb protection bypass via PCF font loading...

GHSA-8V84-F9PQ-WR9X Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Description PIL/PcfFontFile.py loadbitmaps line 227 reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes without calling Image.decompressionbombcheck. Dimensions originate from unsigned 16-bit values: xsize = right - left max: 65535 − 0 = 65535 ysize =...

Oracle Linux 10 : mod_http2 (ELSA-2026-25225)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-25225 advisory. - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 - Resolves: RHEL-182410 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and...

SUSE SLES15 Security Update : python-Pillow (SUSE-SU-2026:3084-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3084-1 advisory. This update for python-Pillow fixes the following issues - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path...