Skip to content
Threat Feed
Subscribe

Product

Pillow (>= 5.1.0, < 12.3.0)

1 brief RSS
low advisory

Pillow Decompression Bomb DoS via PdfParser.PdfStream.decode()

A denial-of-service vulnerability (CVE-2026-59200) exists in Pillow's `PdfParser.PdfStream.decode()` function across versions 5.1.0 to 12.2.x, allowing an unauthenticated attacker to craft a malicious PDF file that, when processed by a vulnerable application, triggers excessive memory allocation (e.g., a ~950 KB file expanding to 1 GB), leading to server Out-of-Memory termination or severe service degradation.

Pillow denial-of-service vulnerability python library pdf
1t 1c