PyPI/pillow CVE-2026-112401: medium 6.9

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Action: Upgrade pillow to 13.0.0 or later.

pip install pillow==13.0.0

Affected

Fixed versions

Sources

• osv: GHSA-74r2-7ff9-mjj2
• nvd: CVE-2026-112401
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2
• https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e
• https://github.com/python-pillow/Pillow
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0

CVE-2026-112401 · published 2026-10-21T20:42:11Z · modified 2026-10-21T21:00:06.702560170Z · JSON