{"id":"CVE-2026-40192","aliases":["BIT-pillow-2026-40192","CLSA-2026-1776904626","CLSA-2026-1778028238","CLSA-2026-1781744117","DEBIAN-CVE-2026-40192","EUVD-2026-23130","GHSA-whj4-6x5x-4v2j","OESA-2026-2064","OESA-2026-2065","OESA-2026-2066","PYSEC-2026-2250","RHSA-2026:24761","RHSA-2026:24762","RHSA-2026:27076","RHSA-2026:34365","RHSA-2026:34366","RHSA-2026:34368","ROOT-APP-PYPI-CVE-2026-40192","SUSE-SU-2026:21382-1","UBUNTU-CVE-2026-40192","USN-8211-1","openSUSE-SU-2026:10575-1","openSUSE-SU-2026:20617-1"],"status":"published","title":"Pillow is vulnerable to a FITS GZIP decompression bomb","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00671,"percentile":0.52296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-409","CWE-770"],"published":"2026-04-13T19:22:35Z","modified":"2026-11-06T11:15:07Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["12.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"pillow","fixed_in":["12.2.0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"pillow","fixed_in":["10.4.0.post2+tuxcare","11.3.0.post2+tuxcare","11.2.1.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["11.1.0-5+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["12.2.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-pillow","fixed_in":["10.3.0-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pillow","fixed_in":["10.3.0-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pillow","fixed_in":["10.3.0-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"pillow","fixed_in":["10.3.0+aikido.2","12.1.0+aikido.3","12.1.0+aikido.4","10.4.0+aikido.1","10.4.0+aikido.2","11.0.0+aikido.1","10.3.0+aikido.3","11.1.0+aikido.1","11.1.0+aikido.4","10.4.0+aikido.3","11.0.0+aikido.2","11.1.0+aikido.2","10.3.0+aikido.4","11.1.0+aikido.3","10.4.0+aikido.4","10.3.0+aikido.5","11.0.0+aikido.3","10.3.0+aikido.6","10.4.0+aikido.5","11.0.0+aikido.4","12.1.0+aikido.5","11.1.0+aikido.5","10.3.0+aikido.7","11.0.0+aikido.5","10.4.0+aikido.6","12.1.0+aikido.6","11.0.0+aikido.6","10.3.0+aikido.8","10.4.0+aikido.7","11.1.0+aikido.6","10.4.0+aikido.8","11.2.1+aikido.1","11.0.0+aikido.7","11.1.0+aikido.7","11.2.1+aikido.2","12.1.0+aikido.7","10.3.0+aikido.9","10.3.0+aikido.10","12.1.0+aikido.8","11.2.1+aikido.3","11.1.0+aikido.8","11.0.0+aikido.8","12.1.0+aikido.9","12.1.0+aikido.10","10.3.0+aikido.11","11.1.0+aikido.9","10.4.0+aikido.9","11.2.1+aikido.4","12.1.0+aikido.11","11.1.0+aikido.10","10.4.0+aikido.10","11.0.0+aikido.9","10.3.0+aikido.12","11.2.1+aikido.5","10.4.0+aikido.11","12.1.0+aikido.12","11.2.1+aikido.6","11.1.0+aikido.11","10.3.0+aikido.13","11.0.0+aikido.10","11.2.1+aikido.7","11.1.0+aikido.12","10.4.0+aikido.12","11.1.0+aikido.13","12.1.0+aikido.13","10.3.0+aikido.14","11.0.0+aikido.11","10.3.0+aikido.15","10.4.0+aikido.13","11.2.1+aikido.8","11.0.0+aikido.12","11.1.0+aikido.14","12.1.0+aikido.14","10.3.0+aikido.16","10.4.0+aikido.14","11.1.0+aikido.15","11.2.1+aikido.9","10.4.0+aikido.15","12.1.0+aikido.15","10.3.0+aikido.17","11.0.0+aikido.13","10.4.0+aikido.16","10.3.0+aikido.18","10.3.0+aikido.19","10.4.0+aikido.17","10.3.0+aikido.20","11.0.0+aikido.14","10.4.0+aikido.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"pillow","fixed_in":["11.3.0-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pillow","fixed_in":["12.1.1-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","fixed_in":["12.2.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-Pillow","fixed_in":["11.3.0-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.3.0"},{"fixed":"12.2.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"pillow","ranges":[{"type":"SEMVER","events":[{"introduced":"10.3.0"},{"fixed":"12.2.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.0"},{"fixed":"10.4.0.post2+tuxcare"}]}],"versions":["10.4.0","10.4.0.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.3.0"},{"fixed":"11.3.0.post2+tuxcare"}]}],"versions":["11.3.0","11.3.0.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.1"},{"fixed":"11.2.1.post2+tuxcare"}]}],"versions":["11.2.1","11.2.1.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.0-5+deb13u2"}]}],"versions":["11.1.0-5","11.1.0-5+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.0-1"}]}],"versions":["11.1.0-5","11.2.1-1","11.3.0-1","12.0.0-1","12.1.0-1","12.1.1-1","12.1.1-2"]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.3.0"},{"fixed":"12.2.0"}]}],"versions":["10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.3.0"},{"fixed":"12.2.0"}]}],"versions":["10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-3.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-3.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.29-2.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.29-2.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-6.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.9-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python3-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python3-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-click","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.3.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.12-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"python3.12-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:46.0.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-5.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-5.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.1.el8sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el8pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.7-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-5.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.5-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"candlepin-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.5-1.el9sat"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"dynflow-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-5.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.17-1.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-5.el9sat"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.2.0-1.el9pc"}]}],"bundled":6},{"source":"osv","ecosystem":"Root:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0+aikido.2"},{"fixed":"12.1.0+aikido.3"},{"fixed":"12.1.0+aikido.4"},{"fixed":"10.4.0+aikido.1"},{"fixed":"10.4.0+aikido.2"},{"fixed":"11.0.0+aikido.1"},{"fixed":"10.3.0+aikido.3"},{"fixed":"11.1.0+aikido.1"},{"fixed":"11.1.0+aikido.4"},{"fixed":"10.4.0+aikido.3"},{"fixed":"11.0.0+aikido.2"},{"fixed":"11.1.0+aikido.2"},{"fixed":"10.3.0+aikido.4"},{"fixed":"11.1.0+aikido.3"},{"fixed":"10.4.0+aikido.4"},{"fixed":"10.3.0+aikido.5"},{"fixed":"11.0.0+aikido.3"},{"fixed":"10.3.0+aikido.6"},{"fixed":"10.4.0+aikido.5"},{"fixed":"11.0.0+aikido.4"},{"fixed":"12.1.0+aikido.5"},{"fixed":"11.1.0+aikido.5"},{"fixed":"10.3.0+aikido.7"},{"fixed":"11.0.0+aikido.5"},{"fixed":"10.4.0+aikido.6"},{"fixed":"12.1.0+aikido.6"},{"fixed":"11.0.0+aikido.6"},{"fixed":"10.3.0+aikido.8"},{"fixed":"10.4.0+aikido.7"},{"fixed":"11.1.0+aikido.6"},{"fixed":"10.4.0+aikido.8"},{"fixed":"11.2.1+aikido.1"},{"fixed":"11.0.0+aikido.7"},{"fixed":"11.1.0+aikido.7"},{"fixed":"11.2.1+aikido.2"},{"fixed":"12.1.0+aikido.7"},{"fixed":"10.3.0+aikido.9"},{"fixed":"10.3.0+aikido.10"},{"fixed":"12.1.0+aikido.8"},{"fixed":"11.2.1+aikido.3"},{"fixed":"11.1.0+aikido.8"},{"fixed":"11.0.0+aikido.8"},{"fixed":"12.1.0+aikido.9"},{"fixed":"12.1.0+aikido.10"},{"fixed":"10.3.0+aikido.11"},{"fixed":"11.1.0+aikido.9"},{"fixed":"10.4.0+aikido.9"},{"fixed":"11.2.1+aikido.4"},{"fixed":"12.1.0+aikido.11"},{"fixed":"11.1.0+aikido.10"},{"fixed":"10.4.0+aikido.10"},{"fixed":"11.0.0+aikido.9"},{"fixed":"10.3.0+aikido.12"},{"fixed":"11.2.1+aikido.5"},{"fixed":"10.4.0+aikido.11"},{"fixed":"12.1.0+aikido.12"},{"fixed":"11.2.1+aikido.6"},{"fixed":"11.1.0+aikido.11"},{"fixed":"10.3.0+aikido.13"},{"fixed":"11.0.0+aikido.10"},{"fixed":"11.2.1+aikido.7"},{"fixed":"11.1.0+aikido.12"},{"fixed":"10.4.0+aikido.12"},{"fixed":"11.1.0+aikido.13"},{"fixed":"12.1.0+aikido.13"},{"fixed":"10.3.0+aikido.14"},{"fixed":"11.0.0+aikido.11"},{"fixed":"10.3.0+aikido.15"},{"fixed":"10.4.0+aikido.13"},{"fixed":"11.2.1+aikido.8"},{"fixed":"11.0.0+aikido.12"},{"fixed":"11.1.0+aikido.14"},{"fixed":"12.1.0+aikido.14"},{"fixed":"10.3.0+aikido.16"},{"fixed":"10.4.0+aikido.14"},{"fixed":"11.1.0+aikido.15"},{"fixed":"11.2.1+aikido.9"},{"fixed":"10.4.0+aikido.15"},{"fixed":"12.1.0+aikido.15"},{"fixed":"10.3.0+aikido.17"},{"fixed":"11.0.0+aikido.13"},{"fixed":"10.4.0+aikido.16"},{"fixed":"10.3.0+aikido.18"},{"fixed":"10.3.0+aikido.19"},{"fixed":"10.4.0+aikido.17"},{"fixed":"10.3.0+aikido.20"},{"fixed":"11.0.0+aikido.14"},{"fixed":"10.4.0+aikido.18"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-1ubuntu1.2"}]}],"versions":["11.1.0-5build1","11.3.0-1ubuntu1","11.3.0-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.1-2ubuntu1.1"}]}],"versions":["11.3.0-1ubuntu1","11.3.0-1ubuntu2","12.0.0-1ubuntu1","12.1.1-1ubuntu1","12.1.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-1ubuntu1.2"}]}],"versions":["11.1.0-5build1","11.3.0-1ubuntu1","11.3.0-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.1-2ubuntu1.1"}]}],"versions":["11.3.0-1ubuntu1","11.3.0-1ubuntu2","12.0.0-1ubuntu1","12.1.1-1ubuntu1","12.1.1-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.2.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-160000.4.1"}]}]}],"products":[{"vendor":"python","product":"pillow"},{"vendor":"python-pillow","product":"pillow"},{"vendor":"red hat","product":"lightspeed core"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat ai inference server 3.4"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.3"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.14"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.17"},{"vendor":"red hat","product":"red hat quay 3.9"},{"vendor":"red hat","product":"red hat satellite 6.16 for rhel 8"},{"vendor":"red hat","product":"red hat satellite 6.16 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.17 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.18 for rhel 9"},{"vendor":"red hat","product":"red hat satellite 6.19 for rhel 9"}],"references":[{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j","tags":["x_refsource_CONFIRM","Mitigation","Patch","Vendor Advisory","advisory","web","fix","article","report"]},{"url":"https://github.com/python-pillow/Pillow/pull/9521","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","article","report"]},{"url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb","tags":["x_refsource_MISC","Release Notes","article","web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40192","tags":["vdb-entry","x_refsource_REDHAT","web","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458856","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27076","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24762","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34366","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34368","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34365","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61628","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61627","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61629","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16008","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16030","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16009","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16174","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57387","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17611","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17609","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-whj4-6x5x-4v2j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40192.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40192","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2064","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2065","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2066","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452458","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24761.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-62718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-62718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62718","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc1034#section-3.1","tags":["article"]},{"url":"https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2","tags":["article"]},{"url":"https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df","tags":["article"]},{"url":"https://github.com/axios/axios/pull/10661","tags":["article"]},{"url":"https://github.com/axios/axios/releases/tag/v1.15.0","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4926","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-7246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7246","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7246","tags":["advisory"]},{"url":"https://github.com/pallets/click/releases/tag/8.3.3","tags":["article"]},{"url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-30922","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-30922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30922","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32280","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","tags":["advisory"]},{"url":"https://go.dev/cl/758320","tags":["article"]},{"url":"https://go.dev/issue/78282","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4947","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://go.dev/cl/763761","tags":["article"]},{"url":"https://go.dev/issue/78293","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","tags":["advisory"]},{"url":"https://go.dev/cl/763767","tags":["article"]},{"url":"https://go.dev/issue/78334","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4870","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33891","tags":["advisory"]},{"url":"https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33894","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33894","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33894","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc2313#section-8","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp","tags":["article"]},{"url":"https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc8017.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33895","tags":["advisory"]},{"url":"https://datatracker.ietf.org/doc/html/rfc8032#section-8.4","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33896","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33896","tags":["advisory"]},{"url":"https://github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90","tags":["article"]},{"url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39363","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39363","tags":["advisory"]},{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39892","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/08/12","tags":["article"]},{"url":"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40192","tags":["advisory","report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457432","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24762.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40175","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40175","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1","tags":["article"]},{"url":"https://github.com/axios/axios/pull/10660","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418462","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-44720","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45906","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27076.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61729","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","tags":["advisory"]},{"url":"https://go.dev/cl/725920","tags":["article"]},{"url":"https://go.dev/issue/76445","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4155","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://go.dev/cl/752180","tags":["article"]},{"url":"https://go.dev/issue/77578","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33186","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33186","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45957","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46096","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46097","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46098","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46101","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46102","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46103","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46106","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46107","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34365.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452230","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5135","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5136","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5138","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452971","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5138","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5142","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442671","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27727","tags":["advisory"]},{"url":"https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44","tags":["article"]},{"url":"https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal","tags":["article"]},{"url":"https://www.mchange.com/projects/c3p0/#configuring_security","tags":["article"]},{"url":"https://www.mchange.com/projects/c3p0/#security-note","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://go.dev/cl/763763","tags":["article"]},{"url":"https://go.dev/issue/78332","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-44719","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45923","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34366.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-47204","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34368.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621382-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262184","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40192","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-40192","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8211-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40192","title":"Pillow is vulnerable to a FITS GZIP decompression bomb","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-15T22:53:56.147Z","modified":"2026-09-10T12:04:47.474Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770","CWE-400","CWE-409"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-23130","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-15T22:53:56Z","modified":"2026-09-10T12:04:47Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:25.63332Z"}],"ghsa":[{"id":"GHSA-whj4-6x5x-4v2j","title":"FITS GZIP decompression bomb in Pillow","description":"### Impact\nPillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).\n\n### Patches\nThe amount of data read is now limited to the necessary amount.\nFixed in Pillow 12.2.0 (PR #9521).\n\n### Workarounds\nAvoid Pillow \u003e= 10.3.0, \u003c 12.2.0\nOnly open [specific image formats](https://pillow.readthedocs.io/en/stable/releasenotes/8.0.0.html#image-open-add-formats-parameter), excluding FITS.","status":"published","published":"2026-04-13T19:22:35Z","modified":"2026-04-27T16:21:40Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:39:58.897998Z"}],"nvd":[{"id":"CVE-2026-40192","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-15T23:16:10.053Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770","CWE-409"],"updated_at":"2026-11-02T14:12:14.748836Z"}],"osv":[{"id":"CVE-2026-40192","title":"Pillow is vulnerable to a FITS GZIP decompression bomb","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-15T22:53:56.147Z","modified":"2026-10-28T02:31:10.420446903Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-40192","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-15T23:16:10.053Z","modified":"2026-10-27T09:47:41.642481254Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-whj4-6x5x-4v2j","title":"FITS GZIP decompression bomb in Pillow","description":"### Impact\nPillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).\n\n### Patches\nThe amount of data read is now limited to the necessary amount.\nFixed in Pillow 12.2.0 (PR #9521).\n\n### Workarounds\nAvoid Pillow \u003e= 10.3.0, \u003c 12.2.0\nOnly open [specific image formats](https://pillow.readthedocs.io/en/stable/releasenotes/8.0.0.html#image-open-add-formats-parameter), excluding FITS.","status":"published","published":"2026-04-13T19:22:35Z","modified":"2026-09-10T03:51:03.847830288Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"OESA-2026-2064","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.(CVE-2026-40192)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:49.022653006Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2065","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.(CVE-2026-40192)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:49.454284003Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2066","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.(CVE-2026-40192)","status":"published","published":"2026-04-25T11:11:04Z","modified":"2026-08-18T01:19:49.037674998Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2026-2250","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-15T23:16:10.053Z","modified":"2026-07-13T07:26:24.246094941Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2026:24761","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-06-10T10:07:59Z","modified":"2026-10-20T10:06:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:24762","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-06-10T10:08:00Z","modified":"2026-10-20T10:06:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:27076","title":"Red Hat Security Advisory: Satellite 6.16.9 Async Update","status":"published","published":"2026-06-19T10:06:55Z","modified":"2026-10-20T10:06:45Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:34365","title":"Red Hat Security Advisory: Satellite 6.19.2 Async Update","status":"published","published":"2026-07-02T10:17:42Z","modified":"2026-10-20T10:07:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:34366","title":"Red Hat Security Advisory: Satellite 6.17.9 Async Update","status":"published","published":"2026-07-02T10:17:42Z","modified":"2026-10-20T10:07:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:34368","title":"Red Hat Security Advisory: Satellite 6.18.7 Async Update","status":"published","published":"2026-07-02T10:17:43Z","modified":"2026-10-20T10:07:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"ROOT-APP-PYPI-CVE-2026-40192","title":"CVE-2026-40192 in pillow - Patched by Root","description":"Root has patched CVE-2026-40192 in the pillow package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-06T10:13:42Z","modified":"2026-11-06T11:15:07.497195306Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T11:42:45.055937Z"},{"id":"UBUNTU-CVE-2026-40192","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-17T00:00:00Z","modified":"2026-06-30T18:18:00.158238822Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"BIT-pillow-2026-40192","title":"Pillow is vulnerable to a FITS GZIP decompression bomb","description":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.","status":"published","published":"2026-04-18T08:46:42.614Z","modified":"2026-09-10T09:30:05.75045149Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CLSA-2026-1776904626","title":"TuxCare security update for pillow (1 CVE)","description":"TuxCare rebuilt pillow to address 1 CVE. Fixed in 10.4.0.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:48:04.927524344Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778028238","title":"TuxCare security update for pillow (1 CVE)","description":"TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.3.0.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:48:04.966309064Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1781744117","title":"TuxCare security update for pillow (1 CVE)","description":"TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.2.1.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:48:01.021489003Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"openSUSE-SU-2026:10575-1","title":"python311-Pillow-12.2.0-2.1 on GA media","description":"These are all security issues fixed in the python311-Pillow-12.2.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-18T00:00:00Z","modified":"2026-04-19T10:30:10.472228Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20617-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issue:\n\n- CVE-2026-40192: Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a\n  FITS image, making them vulnerable to decompression bomb attacks (bsc#1262184).\n","status":"published","published":"2026-04-22T21:45:29Z","modified":"2026-04-25T18:25:23.355221Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21382-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issue:\n\n- CVE-2026-40192: Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a\n  FITS image, making them vulnerable to decompression bomb attacks (bsc#1262184).\n","status":"published","published":"2026-04-22T21:48:22Z","modified":"2026-04-29T18:24:00.496563Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8211-1","title":"pillow vulnerability","description":"It was discovered that Pillow incorrectly handled certain FITS images. An\nattacker could possibly use this issue to cause Pillow to consume\nresources, leading to a denial of service.","status":"published","published":"2026-04-27T12:33:24Z","modified":"2026-06-30T18:15:54.426792481Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}