DEBIAN-CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

DEBIAN-CVE-2026-96643

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96643

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...

CVE-2026-114138

A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service DoS by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex parameters. Because the framework performs unbounded and...

CVE-2026-114144

A flaw was found in toml-node. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted TOML document containing excessively long numeric sequences. When parsing these unbounded values, the application consumes excessive CPU resources and blocks the main execution...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96640

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearizepagetree in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save..., format="PDF", append=True processes an attacker-controlled existing PDF whose...

CVE-2026-96643

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...

CVE-2026-96643

The Pillow Python imaging library (versions 11.0.0 through 13.0.0 ) is vulnerable to an inefficient algorithmic complexity issue (CWE-407 ). The root cause resides in src/PIL/Image.py, where Exif.load() repeatedly slices EXIF data starting with a six-byte header. Because src/PIL/PngImagePlugin.py...

CVE-2026-96643 Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...

CVE-2026-96643

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...

CVE-2026-96643 Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new...

CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

CVE-2026-96642

The Pillow Python imaging library is vulnerable to an infinite CPU-spin loop in the TarIO initializer (located in src/PIL/TarIO.py) in versions prior to 13.0.0 . The root cause is the acceptance of a negative octal member size , which triggers a backward seek that returns to the same 512-byte hea...

CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

GHSA-22HG-R758-RRW9 Pillow: Infinite loop in MIC n_frames when the embedded TIFF

============================================================================ Infinite loop in MIC nframes when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell Commit: a707c6b21c313880d0771e54965d142dd42358b6...

EUVD-2026-104598

Pillow: Infinite loop in MIC nframes when the embedded TIFF...

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

============================================================================ Infinite loop in MIC nframes when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...