Critical Security Update for python3-pillow: Denial of Service Vulnerabilities
Summary
ALSA-2026:39127: Important: python-pillow security update. Affects python3-pillow versions < 5.1.1-22.el8_10. Fixed in 5.1.1-22.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-pillow is a powerful image processing library in Python that supports opening, manipulating, and saving many different image file formats. It is widely used for its ease of use and extensive capabilities in handling images. However, recent vulnerabilities have been identified that could allow attackers to exploit the library, leading to denial of service conditions.
Vulnerability Detail
The vulnerabilities in python3-pillow stem from improper handling of crafted font and image files. Specifically, attackers can exploit these vulnerabilities by supplying malicious BDF font files, GD 2.x image files, or PCF font data, which can lead to excessive memory allocation and ultimately cause denial of service. This means that legitimate users may be unable to access the application or service utilizing this library, resulting in potential downtime and loss of service availability.
How To Fix
Minimum fixed version
5.1.1-22.el8_10
This is the first release that contains the fix.
sudo dnf update python3-pillowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid processing untrusted or crafted font and image files until the package is updated. This may help mitigate the risk of denial of service attacks while waiting for the official patch.
Conclusion
In summary, the python3-pillow library has critical vulnerabilities that can lead to denial of service. It is crucial to update to the latest patched version to protect your applications. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for python3-pillow →
FAQ
Python3-pillow is an image processing library for Python that allows users to open, manipulate, and save various image formats.
The vulnerabilities can lead to denial of service, meaning that users may be unable to access applications that rely on the python3-pillow library.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If you cannot update the package right away, avoid processing untrusted files and monitor for any signs of exploitation.
For more details, refer to the CVE pages associated with the vulnerabilities, such as CVE-2026-54059 and CVE-2026-55380.
Related vulnerabilities
Recent vulnerabilities recorded for python3-pillow.
