CVE-2026-40192

python pillow

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-40192

Katalog CVE

CVSS 7.5 · High EPSS 0,87%

Kerentanan Uncontrolled Resource Consumption pada python pillow. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.

Rincian

Terbit di NVD
15 April 2026
Terakhir diubah
10 September 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
EPSS (30 hari)
0,87% peluang dieksploitasi; lebih tinggi dari 57,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
python pillow Versi 10.3.0 hingga sebelum 12.2.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.