CVE-2026-40192: python-pillow pillow Uncontrolled Resource Consumption
CVSS: 8.7v4.0HighModified
AliasesGHSA-whj4-6x5x-4v2jBIT-pillow-2026-40192PYSEC-2026-2250UBUNTU-CVE-2026-40192DEBIAN-CVE-2026-40192CGA-2g23-43p3-hhggCGA-5gvv-p777-f7pqCGA-g24m-f5jf-jq43CGA-h5hg-4qmv-r69pCGA-hcjq-9mp6-qvpqCGA-qph8-5v4f-75qcCGA-w7qg-8xpr-jm6vCGA-xc33-g9jf-28g6openSUSE-SU-2026:10575-1openSUSE-SU-2026:20617-1CGA-7c6x-9vrf-f8hrCGA-8m9m-hr2g-42f5CGA-9wx4-9qjj-7h75CGA-fr96-855r-vvr8CGA-m668-8pr4-wrrxCGA-rjpr-wgj2-vh97
Published 15-04-2026Last modified 10-09-2026
Vulnerability summary
CVE-2026-40192 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in python-pillow pillow. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58% of scored vulnerabilities.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.87%
0%100%
Low · +0.20 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 15-04-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.
CVSS metrics
10 scores · 7 sources · 2 versionsHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.87%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
+0.20 pp
From 0.67% on 19-09-2026
19-09-202619-10-2026
EPSS score0.87%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Affected systems
Chainguard9 products
- kubeflow-pipelines-visualization-server< 2.16.1-r1
- litellm< 1.83.10.0-r0
- mlflow< 3.16.0-r0
- open-webui< 0.8.12-r4 | < 0.9.2-r0 | < 0.11.0-r0
- py3.10-vllm-cuda-12.4< 0.18.1-r1
Wolfi4 products
- kubeflow-pipelines-visualization-server< 2.16.1-r1
- mlflow< 3.16.0-r0
- open-webui< 0.8.12-r4 | < 0.9.2-r0 | < 0.11.0-r0
- superset-6.0< 6.0.0-r10
Opensuse2 products
- python-Pillow&distro=openSUSE Leap 16.0< 11.3.0-160000.4.1
- python-Pillow&distro=openSUSE Tumbleweed< 12.2.0-2.1
Debian1 product
- pillow< 11.1.0-5+deb13u2 | < 12.2.0-1
PyPI1 product
- pillow≥ 10.3.0, < 12.2.0
Python1 product
- pillow≥ 10.3.0, < 12.2.0
Python-pillow1 product
- pillow≥ 10.3.0, < 12.2.0
Ubuntu1 product
- pillow< 11.3.0-1ubuntu1.2 | < 12.1.1-2ubuntu1.1
8 vendors · 20 products
References
44 links- github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2jX Refsource CONFIRMWEBFIXREPORTAdvisoryMitigationPatchVendor Advisory
- github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628X Refsource MISCWEBFIXPatch
