Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Pillow vulnerabilities (USN-8999-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8999-1 advisory. It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could...

USN-8999-1: Pillow vulnerabilities

It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. CVE-2026-54058 It was discovered that Pillow did not properly check for decompressio...

CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-109398

The Gumlet php-image-resize library (versions before 3.0.1 ) is vulnerable to a Denial of Service (DoS) attack via decompression bombs . The root cause is located in the ImageResize constructor within lib/ImageResize.php, which passes images to GD imagecreatefrom* functions without enforcing pixe...

CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-44163 fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the inopentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry...

CVE-2026-44163 fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the inopentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

EUVD-2026-35098

Req vulnerable to unbounded archive/compression extraction triggered by response content-type...

UBUNTU-CVE-2026-15709

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Impacturllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once.urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header e.g., gzip,...

EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-2461)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP- compressed data read when decoding a...

fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

The fluent-plugin-opentelemetry plugin specifically the inopentelemetry HTTP input lacked strict size limits on incoming requests. It was discovered that the plugin read the entire request body and decompressed payloads into memory without enforcing maximum size thresholds. If the OpenTelemetry...