Every CVE Search/ Get API key

CVE-2026-40192

Pillow is vulnerable to a FITS GZIP decompression bomb

8.7 HighFix available

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.67%Up 0.6 points since Apr 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Pillow is vulnerable to a FITS GZIP decompression bomb

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
CVE-2026-40192
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770, CWE-400, CWE-409
Updated
2026-11-02
EUVDEUVD-2026-23130 8.7

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
EUVD-2026-23130
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-whj4-6x5x-4v2j 8.7

FITS GZIP decompression bomb in Pillow

Impact

Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

Patches

The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521).

Workarounds

Avoid Pillow >= 10.3.0, < 12.2.0 Only open specific image formats, excluding FITS.

Record
GHSA-whj4-6x5x-4v2j
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
NVD 8.7

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
CVE-2026-40192
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770, CWE-409
Updated
2026-11-02
OSV 8.7

Pillow is vulnerable to a FITS GZIP decompression bomb

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
CVE-2026-40192
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-40192 7.5

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
DEBIAN-CVE-2026-40192
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 21 moreShow less
OSVGHSA-whj4-6x5x-4v2j 8.7

FITS GZIP decompression bomb in Pillow

Impact

Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

Patches

The amount of data read is now limited to the necessary amount. Fixed in Pillow 12.2.0 (PR #9521).

Workarounds

Avoid Pillow >= 10.3.0, < 12.2.0 Only open specific image formats, excluding FITS.

Record
GHSA-whj4-6x5x-4v2j
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVOESA-2026-2064 8.7

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.(CVE-2026-40192)

Record
OESA-2026-2064
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2065 8.7

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.(CVE-2026-40192)

Record
OESA-2026-2065
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2066 8.7

python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.(CVE-2026-40192)

Record
OESA-2026-2066
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVPYSEC-2026-2250 7.5

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
PYSEC-2026-2250
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:24761 7.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2026:24761
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:24762 8.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record
RHSA-2026:24762
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:27076 9.1

Red Hat Security Advisory: Satellite 6.16.9 Async Update

Record
RHSA-2026:27076
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:34365 8.8

Red Hat Security Advisory: Satellite 6.19.2 Async Update

Record
RHSA-2026:34365
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:34366 8.8

Red Hat Security Advisory: Satellite 6.17.9 Async Update

Record
RHSA-2026:34366
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:34368 8.8

Red Hat Security Advisory: Satellite 6.18.7 Async Update

Record
RHSA-2026:34368
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2026-40192 7.5

CVE-2026-40192 in pillow - Patched by Root

Root has patched CVE-2026-40192 in the pillow package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2026-40192
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2026-40192 8.7

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
UBUNTU-CVE-2026-40192
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-pillow-2026-40192 No score

Pillow is vulnerable to a FITS GZIP decompression bomb

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Record
BIT-pillow-2026-40192
Updated
2026-11-02
OSVCLSA-2026-1776904626 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 10.4.0.post2+tuxcare.

Record
CLSA-2026-1776904626
Updated
2026-11-02
OSVCLSA-2026-1778028238 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.3.0.post2+tuxcare.

Record
CLSA-2026-1778028238
Updated
2026-11-02
OSVCLSA-2026-1781744117 No score

TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.2.1.post2+tuxcare.

Record
CLSA-2026-1781744117
Updated
2026-11-02
OSVopenSUSE-SU-2026:10575-1 No score

python311-Pillow-12.2.0-2.1 on GA media

These are all security issues fixed in the python311-Pillow-12.2.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10575-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20617-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issue:

  • CVE-2026-40192: Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks (bsc#1262184).
Record
openSUSE-SU-2026:20617-1
Updated
2026-11-02
OSVSUSE-SU-2026:21382-1 No score

Security update for python-Pillow

This update for python-Pillow fixes the following issue:

  • CVE-2026-40192: Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks (bsc#1262184).
Record
SUSE-SU-2026:21382-1
Updated
2026-11-02
OSVUSN-8211-1 No score

pillow vulnerability

It was discovered that Pillow incorrectly handled certain FITS images. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service.

Record
USN-8211-1
Updated
2026-11-02

Affected products

Show 19 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
pillow
PyPI
 10.3.0 up to 12.2.0
12.2.0
pillow
Bitnami
 10.3.0 up to 12.2.0
12.2.0
pillow
TuxCare:PyPI
 10.4.0 up to 10.4.0.post2+tuxcare, plus listed versions
10.4.0.post1+tuxcare
10.4.0.post2+tuxcare
pillow
TuxCare:PyPI
 11.3.0 up to 11.3.0.post2+tuxcare, plus listed versions
11.3.0.post1+tuxcare
11.3.0.post2+tuxcare
pillow
TuxCare:PyPI
 11.2.1 up to 11.2.1.post2+tuxcare, plus listed versions
11.2.1.post1+tuxcare
11.2.1.post2+tuxcare
pillow
Debian:13
 before 11.1.0-5+deb13u2, plus listed versions
11.1.0-511.1.0-5+deb13u1
11.1.0-5+deb13u2
pillow
Debian:14
 before 12.2.0-1, plus listed versions
11.1.0-511.2.1-111.3.0-112.0.0-112.1.0-112.1.1-112.1.1-2
12.2.0-1
pillow
PyPI
 10.3.0 up to 12.2.0, plus listed versions
10.4.011.0.011.1.011.2.111.3.012.0.012.1.012.1.1
12.2.0
python-pillow
openEuler:24.03-LTS
 before 10.3.0-3.oe2403
10.3.0-3.oe2403
python-pillow
openEuler:24.03-LTS-SP1
 before 10.3.0-3.oe2403sp1
10.3.0-3.oe2403sp1
Show 184 moreShow less
Affected packages
PackageAffectedFixed
python-pillow
openEuler:24.03-LTS-SP3
 before 10.3.0-3.oe2403sp3
10.3.0-3.oe2403sp3
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
 before 0:2.5.20260422-3.el8ap
0:2.5.20260422-3.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
 before 0:2.5.20260422-3.el9ap
0:2.5.20260422-3.el9ap
python3.12-click
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 16 CVEs
 before 0:8.3.3-1.el8ap
0:8.3.3-1.el8ap
python3.12-click
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 16 CVEs
 before 0:8.3.3-1.el8ap
0:8.3.3-1.el8ap
python3.12-click
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
 before 0:8.3.3-1.el8ap
0:8.3.3-1.el8ap
python3.12-click
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 16 CVEs
 before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 16 CVEs
 before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
 before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
 before 0:4.6.29-2.el8ap
0:4.6.29-2.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
 before 0:4.6.29-2.el9ap
0:4.6.29-2.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 16 CVEs
 before 0:1.6.5-1.el8ap
0:1.6.5-1.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 16 CVEs
 before 0:1.6.5-1.el8ap
0:1.6.5-1.el8ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
 before 0:2.5.10-6.el8ap
0:2.5.10-6.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
 before 0:1.6.5-1.el8ap
0:1.6.5-1.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 16 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 16 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
 before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 16 CVEs
 before 0:46.0.7-1.el8ap
0:46.0.7-1.el8ap
python3.12-cryptography
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 16 CVEs
 before 0:46.0.7-1.el8ap
0:46.0.7-1.el8ap
python3.12-cryptography
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
 before 0:46.0.7-1.el8ap
0:46.0.7-1.el8ap
python3.12-cryptography
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 16 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 16 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 16 CVEs
 before 0:12.2.0-1.el8ap
0:12.2.0-1.el8ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 16 CVEs
 before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
automation-platform-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.9-1.el9ap
0:2.6.9-1.el9ap
python3-click
Red Hat:ansible_automation_platform_developer:2.6::el10
From an advisory covering 12 CVEs
 before 0:8.3.3-1.el10ap
0:8.3.3-1.el10ap
python3-click
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:8.3.3-1.el10ap
0:8.3.3-1.el10ap
python3.12-click
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
python3.12-click
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:8.3.3-1.el9ap
0:8.3.3-1.el9ap
automation-controller
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:4.7.12-1.el9ap
0:4.7.12-1.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el10
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el10ap
0:1.6.5-1.el10ap
receptor
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:2.6.14-3.el9ap
0:2.6.14-3.el9ap
receptor
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:1.6.5-1.el9ap
0:1.6.5-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debuginfo
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debugsource
Red Hat:ansible_automation_platform_developer:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debuginfo
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debugsource
Red Hat:ansible_automation_platform_inside:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-cryptography-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:46.0.7-1.el9ap
0:46.0.7-1.el9ap
python3.12-pillow
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
python3.12-pillow-debuginfo
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
python3.12-pillow-debugsource
Red Hat:ansible_automation_platform:2.6::el9
From an advisory covering 12 CVEs
 before 0:12.2.0-1.el9ap
0:12.2.0-1.el9ap
yggdrasil-worker-forwarder
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:0.0.3-5.el8sat
0:0.0.3-5.el8sat
yggdrasil-worker-forwarder
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:0.0.3-5.el9sat
0:0.0.3-5.el9sat
dynflow-utils
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el8sat
0:1.6.3-1.1.el8sat
dynflow-utils
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el8sat
0:1.6.3-1.1.el8sat
dynflow-utils
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el9sat
0:1.6.3-1.1.el9sat
dynflow-utils
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el9sat
0:1.6.3-1.1.el9sat
python-pillow
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python-pillow-debugsource
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python3.11-pillow
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python3.11-pillow-debuginfo
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python-pillow
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python-pillow-debugsource
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python3.11-pillow
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python3.11-pillow-debuginfo
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python-pillow
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python-pillow-debugsource
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python-pillow
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python-pillow-debugsource
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
foreman
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-debug
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-pcp
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman
Red Hat:satellite_utils:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-cli
Red Hat:satellite_utils:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-cli
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-debug
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-dynflow-sidekiq
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-ec2
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-journald
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-libvirt
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-openstack
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-pcp
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-postgresql
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-redis
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-service
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-telemetry
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
foreman-vmware
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:3.18.0.7-1.el9sat
0:3.18.0.7-1.el9sat
yggdrasil-worker-forwarder
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:0.0.3-5.el9sat
0:0.0.3-5.el9sat
candlepin
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:4.7.5-1.el9sat
0:4.7.5-1.el9sat
candlepin-selinux
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:4.7.5-1.el9sat
0:4.7.5-1.el9sat
python3.12-pillow
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pyjwt+crypto
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:2.13.0-1.el9pc
0:2.13.0-1.el9pc
python3.12-pyjwt
Red Hat:satellite_capsule:6.19::el9
From an advisory covering 13 CVEs
 before 0:2.13.0-1.el9pc
0:2.13.0-1.el9pc
python3.12-pyjwt+crypto
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:2.13.0-1.el9pc
0:2.13.0-1.el9pc
python3.12-pyjwt
Red Hat:satellite:6.19::el9
From an advisory covering 13 CVEs
 before 0:2.13.0-1.el9pc
0:2.13.0-1.el9pc
foreman
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-debug
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-pcp
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman
Red Hat:satellite_utils:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-cli
Red Hat:satellite_utils:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-cli
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-debug
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-dynflow-sidekiq
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-ec2
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-journald
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-libvirt
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-openstack
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-ovirt
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-pcp
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-postgresql
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-redis
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-service
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-telemetry
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
foreman-vmware
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:3.14.0.17-1.el9sat
0:3.14.0.17-1.el9sat
dynflow-utils
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:1.6.3-1.1.el9sat
0:1.6.3-1.1.el9sat
dynflow-utils
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:1.6.3-1.1.el9sat
0:1.6.3-1.1.el9sat
yggdrasil-worker-forwarder
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:0.0.3-5.el9sat
0:0.0.3-5.el9sat
python-pillow
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python-pillow-debugsource
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python-pillow
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python-pillow-debugsource
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.11-pillow-debuginfo
Red Hat:satellite:6.17::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
foreman
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-debug
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-pcp
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman
Red Hat:satellite_utils:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-cli
Red Hat:satellite_utils:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-cli
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-debug
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-dynflow-sidekiq
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-ec2
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-journald
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-libvirt
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-openstack
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-pcp
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-postgresql
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-redis
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-service
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-telemetry
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
foreman-vmware
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:3.16.0.17-1.el9sat
0:3.16.0.17-1.el9sat
yggdrasil-worker-forwarder
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:0.0.3-5.el9sat
0:0.0.3-5.el9sat
python3.12-pillow
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite_capsule:6.18::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debuginfo
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
python3.12-pillow-debugsource
Red Hat:satellite:6.18::el9
From an advisory covering 6 CVEs
 before 0:12.2.0-1.el9pc
0:12.2.0-1.el9pc
pillow
Root:PyPI
 before 10.3.0+aikido.2
10.3.0+aikido.212.1.0+aikido.312.1.0+aikido.410.4.0+aikido.110.4.0+aikido.211.0.0+aikido.110.3.0+aikido.311.1.0+aikido.111.1.0+aikido.410.4.0+aikido.311.0.0+aikido.211.1.0+aikido.210.3.0+aikido.411.1.0+aikido.310.4.0+aikido.410.3.0+aikido.511.0.0+aikido.310.3.0+aikido.610.4.0+aikido.511.0.0+aikido.412.1.0+aikido.511.1.0+aikido.510.3.0+aikido.711.0.0+aikido.510.4.0+aikido.612.1.0+aikido.611.0.0+aikido.610.3.0+aikido.810.4.0+aikido.711.1.0+aikido.610.4.0+aikido.811.2.1+aikido.111.0.0+aikido.711.1.0+aikido.711.2.1+aikido.212.1.0+aikido.710.3.0+aikido.910.3.0+aikido.1012.1.0+aikido.811.2.1+aikido.311.1.0+aikido.811.0.0+aikido.812.1.0+aikido.912.1.0+aikido.1010.3.0+aikido.1111.1.0+aikido.910.4.0+aikido.911.2.1+aikido.412.1.0+aikido.1111.1.0+aikido.1010.4.0+aikido.1011.0.0+aikido.910.3.0+aikido.1211.2.1+aikido.510.4.0+aikido.1112.1.0+aikido.1211.2.1+aikido.611.1.0+aikido.1110.3.0+aikido.1311.0.0+aikido.1011.2.1+aikido.711.1.0+aikido.1210.4.0+aikido.1211.1.0+aikido.1312.1.0+aikido.1310.3.0+aikido.1411.0.0+aikido.1110.3.0+aikido.1510.4.0+aikido.1311.2.1+aikido.811.0.0+aikido.1211.1.0+aikido.1412.1.0+aikido.1410.3.0+aikido.1610.4.0+aikido.1411.1.0+aikido.1511.2.1+aikido.910.4.0+aikido.1512.1.0+aikido.1510.3.0+aikido.1711.0.0+aikido.1310.4.0+aikido.1610.3.0+aikido.1810.3.0+aikido.1910.4.0+aikido.1710.3.0+aikido.2011.0.0+aikido.1410.4.0+aikido.18
pillow
Ubuntu:25.10
 before 11.3.0-1ubuntu1.2, plus listed versions
11.1.0-5build111.3.0-1ubuntu111.3.0-1ubuntu1.1
11.3.0-1ubuntu1.2
pillow
Ubuntu:26.04:LTS
 before 12.1.1-2ubuntu1.1, plus listed versions
11.3.0-1ubuntu111.3.0-1ubuntu212.0.0-1ubuntu112.1.1-1ubuntu112.1.1-2ubuntu1
12.1.1-2ubuntu1.1
python-Pillow
openSUSE:Tumbleweed
 before 12.2.0-2.1
12.2.0-2.1
python-Pillow
openSUSE:Leap 16.0
 before 11.3.0-160000.4.1
11.3.0-160000.4.1

History

History
RecordedChangedSources
affectedOSV
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40192 is a high vulnerability (CVSS 8.7) in Python Pillow, published April 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in pillow 12.2.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 48 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open