{"action":"Upgrade pillow to 12.2.0 or later.","affected":[{"fixed":"12.2.0","introduced":"10.3.0"}],"component":"pillow","cve_ids":["CVE-2026-40192"],"ecosystem":"PyPI","epss":0.00868,"exploited":false,"fixed_versions":["12.2.0"],"ghsa_id":"GHSA-whj4-6x5x-4v2j","id":"tcs_01M5KGYB9PRXAPGEPSBT2C2JCB","modified_at":"2026-07-13T07:26:24.246094941Z","published_at":"2026-04-15T23:16:10.053Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2250","https://access.redhat.com/security/cve/CVE-2026-40192","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17609","https://access.redhat.com/errata/RHSA-2026:17611","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24866","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:34366","https://access.redhat.com/errata/RHSA-2026:34368","https://access.redhat.com/errata/RHSA-2026:37275","https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb","https://bugzilla.redhat.com/show_bug.cgi?id=2458856","https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628","https://github.com/python-pillow/Pillow/pull/9521","https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2250","url":"https://osv.dev/vulnerability/PYSEC-2026-2250"}],"summary":"Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attack"}