https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T09:06:49.720161+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-59200 CVE-2026-59200 — Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() 2026-10-05T09:06:49.736801+00:00

Affected: python-pillow Pillow

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.