{{ message }}
Repository navigation
Security: python-pillow/Pillow
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()GHSA-78g4-xqwv-q3g8 published
Oct 17, 2026 by radarhereHigh -
Quadratic GIF comment copying during saveGHSA-fc9g-5qg7-mf45 published
Oct 17, 2026 by radarhereModerate -
Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1GHSA-654x-cwwv-5j9c published
Oct 19, 2026 by radarhereModerate -
GIF seek keeps rejected size after DecompressionBombError, allowing DoSGHSA-65qm-jvmh-6pqg published
Oct 17, 2026 by radarhereLow -
EPS load(scale) lets Ghostscript render past the decompression bomb limitGHSA-vx6w-vv9f-6gvg published
Oct 17, 2026 by radarhereLow -
ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutesGHSA-xgh8-jp6q-p5x8 published
Oct 17, 2026 by radarhereModerate -
Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)GHSA-jg86-v3jv-hrpm published
Oct 17, 2026 by radarhereModerate -
Quadratic GIF comment concatenation allows DoS in Image.open()GHSA-74r2-7ff9-mjj2 published
Oct 17, 2026 by radarhereModerate -
NULL dereference in ImagingExpand via rank filters on zero-size imagesGHSA-27h8-gf7j-v5hc published
Oct 17, 2026 by radarhereModerate -
Infinite loop in PdfParser.rewrite_pages on page tree Parent cycleGHSA-f2g6-542v-9j58 published
Oct 17, 2026 by radarhereModerate