GHSA-whj4-6x5x-4v2j

Suggest an improvement
Source
https://github.com/advisories/GHSA-whj4-6x5x-4v2j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-whj4-6x5x-4v2j/GHSA-whj4-6x5x-4v2j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-whj4-6x5x-4v2j
Aliases
Downstream
CGA (14)
ECHO (1)
MINI (7)
Published
2026-04-13T19:22:35Z
Modified
2026-09-10T03:51:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FITS GZIP decompression bomb in Pillow
Details

Impact

Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

Patches

The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521).

Workarounds

Avoid Pillow >= 10.3.0, < 12.2.0 Only open specific image formats, excluding FITS.

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-13T19:22:35Z",
    "nvd_published_at":  "2026-04-15T23:16:10Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / pillow

Package

Name
pillow
View open source insights on deps.dev
Purl
pkg:pypi/pillow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.3.0
Fixed
12.2.0

Affected versions

10.*
10.3.0
10.4.0
11.*
11.0.0
11.1.0
11.2.1
11.3.0
12.*
12.0.0
12.1.0
12.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-whj4-6x5x-4v2j/GHSA-whj4-6x5x-4v2j.json"