CVE-2026-116577

The Python web framework Tornado is vulnerable to quadratic CPU consumption in versions prior to 6.6 . The issue resides in the HTTP header parser , which accepts obsolete line folding and repeatedly concatenates short continuation lines. This allows an unauthenticated client to block the IOLoop ...

CVE-2026-116577 Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

TornadoWeb Tornado resource management error vulnerability

Versions of TornadoWeb prior to 6.6 contain a resource management error vulnerability. This vulnerability arises because the HTTP header parser performs line folding and repeatedly concatenates short continuation lines upon receipt, resulting in a quadratic increase in CPU consumption on IOLoop...

PT-2026-125125

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.6 Description The HTTP header parser in this Python web framework and asynchronous networking library accepts obsolete line folding. An unauthenticated client can submit a header block with numerous short continuati...

PT-2026-123488

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile. open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controll...

EUVD-2026-104662

Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open for minutes...

SUSE CVE-2026-112901

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

Linux Distros Unpatched Vulnerability : CVE-2026-112901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular- expression denial of service. In XbmImageFile.open, wh...

PYSEC-2026-4335

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

DEBIAN-CVE-2026-112901

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

CVE-2026-112901

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

PYSEC-2026-4335

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

CVE-2026-112901

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

CVE-2026-112901

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

PT-2026-117687

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The XBM header parser in the Python imaging library is susceptible to a regular-expression denial of service. When the Image.open function is called on a specially crafted XBM file, the XbmImagePlugi...

Red Hat: CVE-2026-112901: pillow: Pillow: Denial of Service via crafted XBM image header

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

PT-2026-129107

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile. open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controll...

Pillow Resource Management Error Vulnerability

Pillow versions prior to 13.0.0 have a resource management vulnerability. This vulnerability arises from the XBM header parser using backtracking regular expressions when processing specially crafted XBM files in the XbmImageFile.open function. This may lead to a denial-of-service attack by the...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_7418)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257418 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth header...

Rocky Linux 9 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_7431)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257431 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth header...