Python-Pillow · weakness class
Denial of Service
28 CVEs
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 28 is a mark on the map. Named now: 1 to 26, most at risk first.
- Pillow is vulnerable to a FITS GZIP decompression bomb
- Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
- Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
- Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
- Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
- Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
- Pillow: Infinite loop in MIC n_frames when the embedded TIFF
- Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
- Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
- Pillow: Quadratic GIF comment copying during save
- Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
- Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
- Pillow: APNG background disposal allocates full canvas before decompression bomb check
- Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
- Pillow GdImageFile decompression bomb protection bypass
- Pillow: MSP RLE decoder expands a tiny file into unbounded memory
- Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
- Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
- Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
- Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
- Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
- Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data
- Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
- Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
- Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
- Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.