onyx --cves cve-2026-40192
CVE-2026-40192
- score
- <0.1
- cvss
- 7.5
- epss
- 0.9%
- published
- 2026-04-15
- kev added
- —
- first seen
Pillow 10.3.0 through 12.1.1 contains a decompression bomb vulnerability caused by unlimited GZIP-compressed data read in FITS image decoding, letting attackers cause denial of service via unbounded memory consumption, exploit requires opening a crafted FITS file.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 35
- https://access.redhat.com/errata/RHSA-2026:24853
- https://access.redhat.com/security/cve/CVE-2026-40192
- https://access.redhat.com/errata/RHSA-2026:57387
- https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:22465
- https://access.redhat.com/errata/RHSA-2026:22629
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:27076
- https://bugzilla.redhat.com/show_bug.cgi?id=2458856
- https://access.redhat.com/errata/RHSA-2026:61629
- https://access.redhat.com/errata/RHSA-2026:16030
- https://access.redhat.com/errata/RHSA-2026:21017
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:61627
- https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb
- https://access.redhat.com/errata/RHSA-2026:16174
- https://access.redhat.com/errata/RHSA-2026:17611
- https://access.redhat.com/errata/RHSA-2026:34366
- https://access.redhat.com/errata/RHSA-2026:34368
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:16008
- https://access.redhat.com/errata/RHSA-2026:24761
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
- https://access.redhat.com/errata/RHSA-2026:19375
10 more
- https://access.redhat.com/errata/RHSA-2026:22840
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json
- https://access.redhat.com/errata/RHSA-2026:16009
- https://access.redhat.com/errata/RHSA-2026:24866
- https://access.redhat.com/errata/RHSA-2026:61628
- https://access.redhat.com/errata/RHSA-2026:34365
- https://github.com/python-pillow/Pillow/pull/9521
- https://access.redhat.com/errata/RHSA-2026:17609
- https://access.redhat.com/errata/RHSA-2026:23361
- https://access.redhat.com/errata/RHSA-2026:24762