https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:18:53 +0000 https://db.gcve.eu/vuln/ghsa-whj4-6x5x-4v2j <p><strong>Affected:</strong> PyPI: pillow</p> <p>### Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).</p> <p>### Patches The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521).</p> <p>### Workarounds Avoid Pillow &gt;= 10.3.0, &lt; 12.2.0 Only open [specific image formats](https://pillow.readthedocs.io/en/stable/releasenotes/8.0.0.html#image-open-add-formats-parameter), excluding FITS.</p> <p><strong>Affected:</strong> PyPI: pillow</p> <p>### Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).</p> <p>### Patches The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521).</p> <p>### Workarounds Avoid Pillow &gt;= 10.3.0, &lt; 12.2.0 Only open [specific image formats](https://pillow.readthedocs.io/en/stable/releasenotes/8.0.0.html#image-open-add-formats-parameter), excluding FITS.</p> https://db.gcve.eu/vuln/ghsa-whj4-6x5x-4v2j