EUVD-2026-104638

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open...

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

============================================================================ Quadratic GIF comment concatenation allows DoS in Image.open Location: src/PIL/GifImagePlugin.py:266 in GifImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

GHSA-74R2-7FF9-MJJ2 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

============================================================================ Quadratic GIF comment concatenation allows DoS in Image.open Location: src/PIL/GifImagePlugin.py:266 in GifImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile.seek Commit: a707c6b21c313880d0771e54965d142dd42358b6...

DEBIAN-CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112400 Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-112400

The Pillow Python imaging library (versions 9.2.0 through 13.0.0 ) contains a vulnerability where the GifImageFile._seek function fails to discard rejected frame dimensions after an Image.DecompressionBombError . A remote attacker can provide a crafted GIF that triggers this exception; if the app...

CVE-2026-112400 Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...