Most recent entries from all

bdu:2026-10817

BIT-pillow-2026-42310 — Pillow: PDF Parsing Trailer Infinite Loop (DoS)

Affected: Bitnami: pillow

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.

BREW-aider-CVE-2026-42310 — Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Affected: Homebrew: aider

### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

### Patches Patched version: 12.2.0.

PdfParser (introduced in Pillow 4.2.0) follows Prev pointers in PDF trailers to read cross-reference sections. If a trailer's Prev pointer references an offset that has already been processed — either pointing to itself or forming a longer cycle — the parser enters an infinite loop. Pillow now tracks previously processed trailer offsets and raises an error if a cycle is detected.

### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0

### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9519

certfr-2026-avi-0627 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0627

CLEANSTART-2026-CF65728 — Security fix for CVE-2026-42310 applied in: apache-superset 6.0.0-r5

Affected: CleanStart: apache-superset

Security vulnerability affects the apache-superset package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-317414

fkie_cve-2026-42310

GHSA-r73j-pqj5-w3x7 — Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Affected: PyPI: pillow

### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

### Patches Patched version: 12.2.0.

### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0

### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9519

OESA-2026-2515 — python-pillow security update

Affected: openEuler:24.03-LTS-SP1: python-pillow

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816) Security Fix(es):

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.(CVE-2026-42308)

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.(CVE-2026-42311)

openSUSE-SU-2026:20831-1 — Security update for python-Pillow

Security update for python-Pillow

PYSEC-2026-2874 — Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Affected: PyPI: pillow

### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

### Patches Patched version: 12.2.0.

### Workarounds Use any version but the affected versions: >= 4.2.0, < 12.2.0

### Resources - Fix: https://github.com/python-pillow/Pillow/pull/9519

RHSA-2026:16008 — Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.3 (CUDA)

libxslt: Processing web content may disclose sensitive information gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image giflib: Giflib: Double-free vulnerability leading to memory corruption vim: Vim: Arbitrary code execution via 'helpfile' option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file vim: Vim: Arbitrary code execution via command injection in glob() function Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing Pillow: Pillow: Denial of Service via integer overflow in font processing Pillow: Pillow: Den…

SUSE-SU-2026:1842-1 — Security update for python-Pillow

Security update for python-Pillow

UBUNTU-CVE-2026-42310

Affected: Ubuntu:Pro:14.04:LTS: pillow, Ubuntu:Pro:16.04:LTS: pillow, Ubuntu:Pro:18.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow, Ubuntu:Pro:20.04:LTS: pillow-python2, Ubuntu:22.04:LTS: pillow, Ubuntu:24.04:LTS: pillow, Ubuntu:25.10: pillow, Ubuntu:26.04:LTS: pillow

WID-SEC-W-2026-2455 — Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.