RHSA-2026:39127
Vulnerability from csaf_redhat - Published: 2026-07-14 08:59 - Updated: 2026-07-14 16:17Summary
Red Hat Security Advisory: python-pillow security update
Severity
Important
Notes
Topic: An update for python-pillow is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.
7.5 (High)
Affected products
Fixed
52 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.
7.5 (High)
Affected products
Fixed
52 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
52 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.
7.5 (High)
Affected products
Fixed
52 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
30 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-pillow is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)\n\n* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)\n\n* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)\n\n* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:39127",
"url": "https://access.redhat.com/errata/RHSA-2026:39127"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39127.json"
}
],
"title": "Red Hat Security Advisory: python-pillow security update",
"tracking": {
"current_release_date": "2026-07-14T16:17:36+00:00",
"generator": {
"date": "2026-07-14T16:17:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.2"
}
},
"id": "RHSA-2026:39127",
"initial_release_date": "2026-07-14T08:59:16+00:00",
"revision_history": [
{
"date": "2026-07-14T08:59:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-14T08:59:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-14T16:17:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CRB (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python-pillow-0:5.1.1-22.el8_10.src",
"product": {
"name": "python-pillow-0:5.1.1-22.el8_10.src",
"product_id": "python-pillow-0:5.1.1-22.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow@5.1.1-22.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-22.el8_10.aarch64",
"product": {
"name": "python3-pillow-0:5.1.1-22.el8_10.aarch64",
"product_id": "python3-pillow-0:5.1.1-22.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-22.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"product_id": "python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-22.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product_id": "python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-22.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-22.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-22.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"product": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"product_id": "python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-devel@5.1.1-22.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"product": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"product_id": "python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk@5.1.1-22.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"product": {
"name": "python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"product_id": "python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-22.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"product_id": "python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-22.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product_id": "python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-22.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product_id": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-22.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-22.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"product": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"product_id": "python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-devel@5.1.1-22.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"product": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"product_id": "python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk@5.1.1-22.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-22.el8_10.x86_64",
"product": {
"name": "python3-pillow-0:5.1.1-22.el8_10.x86_64",
"product_id": "python3-pillow-0:5.1.1-22.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-22.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"product_id": "python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-22.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product_id": "python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-22.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product_id": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-22.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-22.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"product": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"product_id": "python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-devel@5.1.1-22.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"product": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"product_id": "python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk@5.1.1-22.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-22.el8_10.s390x",
"product": {
"name": "python3-pillow-0:5.1.1-22.el8_10.s390x",
"product_id": "python3-pillow-0:5.1.1-22.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-22.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"product_id": "python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-22.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"product_id": "python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-22.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"product_id": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-22.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-22.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"product": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"product_id": "python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-devel@5.1.1-22.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"product": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"product_id": "python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk@5.1.1-22.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-0:5.1.1-22.el8_10.i686",
"product": {
"name": "python3-pillow-0:5.1.1-22.el8_10.i686",
"product_id": "python3-pillow-0:5.1.1-22.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow@5.1.1-22.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"product": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"product_id": "python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-devel@5.1.1-22.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"product": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"product_id": "python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debugsource@5.1.1-22.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"product": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"product_id": "python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pillow-debuginfo@5.1.1-22.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"product": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"product_id": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-debuginfo@5.1.1-22.el8_10?arch=i686"
}
}
},
{
"category": "product_version",
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"product": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"product_id": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-tk-debuginfo@5.1.1-22.el8_10?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"product": {
"name": "python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"product_id": "python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-pillow-doc@5.1.1-22.el8_10?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-0:5.1.1-22.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src"
},
"product_reference": "python-pillow-0:5.1.1-22.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python3-pillow-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python3-pillow-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python3-pillow-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-0:5.1.1-22.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686"
},
"product_reference": "python3-pillow-0:5.1.1-22.el8_10.i686",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686"
},
"product_reference": "python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-devel-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-doc-0:5.1.1-22.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch"
},
"product_reference": "python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)",
"product_id": "CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
},
"product_reference": "python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"relates_to_product_reference": "CRB-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-54059",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-06T20:02:21.640821+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497464"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primary consequence is a Denial of Service (DoS), which could make the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Python Pillow library. The PcfFontFile._load_bitmaps() method reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation, leading to a denial of service condition. An attacker could exploit this by providing a specially crafted PCF font file to an application that uses Pillow\u0027s font loading functionality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54059"
},
{
"category": "external",
"summary": "RHBZ#2497464",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497464"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54059"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54059"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"
}
],
"release_date": "2026-07-06T18:46:09.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-14T08:59:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:39127"
},
{
"category": "workaround",
"details": "Do not load PCF fonts from untrusted sources. If PCF font loading is required, validate font file dimensions before passing them to Pillow, or upgrade to Pillow 12.3.0 or later which includes the fix for this vulnerability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted PCF font data"
},
{
"cve": "CVE-2026-54060",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-07-06T20:02:29.509113+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497466"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library\u0027s font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory, leading to a denial of service (DoS) for the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Pillow prior to version 12.3.0. The FontFile.compile() method in PIL/FontFile.py assembles per-glyph images into a combined bitmap using Image.new() without calling Image._decompression_bomb_check(). This allows a specially crafted font file to trigger excessive memory allocation during conversion or saving, leading to denial of service via resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54060"
},
{
"category": "external",
"summary": "RHBZ#2497466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497466"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54060"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54060"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"
}
],
"release_date": "2026-07-06T18:49:23.788000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-14T08:59:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:39127"
},
{
"category": "workaround",
"details": "Avoid loading untrusted font files with Pillow. If processing font files from untrusted sources is required, implement application-level resource limits (e.g., cgroups, ulimit) to restrict memory allocation per process. Upgrading to Pillow 12.3.0 or later resolves this issue.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files"
},
{
"cve": "CVE-2026-55379",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-06T20:01:29.922515+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497452"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library\u0027s image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55379"
},
{
"category": "external",
"summary": "RHBZ#2497452",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497452"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55379"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",
"url": "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"
}
],
"release_date": "2026-07-06T18:52:11.633000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-14T08:59:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:39127"
},
{
"category": "workaround",
"details": "Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted BDF font file"
},
{
"cve": "CVE-2026-55380",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-07-06T20:01:42.245051+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497455"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial-of-service vulnerability was found in Pillow\u0027s GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55380"
},
{
"category": "external",
"summary": "RHBZ#2497455",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497455"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55380"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55380"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst",
"url": "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",
"url": "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"
},
{
"category": "external",
"summary": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm",
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"
}
],
"release_date": "2026-07-06T18:50:14.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-14T08:59:16+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:39127"
},
{
"category": "workaround",
"details": "Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-0:5.1.1-22.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python-pillow-debugsource-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-debuginfo-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-devel-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-doc-0:5.1.1-22.el8_10.noarch",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-0:5.1.1-22.el8_10.x86_64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.aarch64",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.i686",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.ppc64le",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.s390x",
"CRB-8.10.0.Z.MAIN.EUS:python3-pillow-tk-debuginfo-0:5.1.1-22.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…