A FITS file's gzip stream expands without limit in Pillow

FITS GZIP decompression bomb in Pillow

Advisory

CVE-2026-40192

Library

Pillow, pillow on PyPI

Published

2026-04-13

Severity

7.5 out of 10, as published

Affected

>= 10.3.0, < 12.2.0

Fixed in

12.2.0

Reaches you

by opening a file

What triggers it

Image.open on a FITS file whose GZIP-compressed data expands far beyond the image it declares.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the format check.

A FITS file is not one of the four formats a scan can be; sillybos does not know the format and refuses it as unknown before Pillow sees it. The advisory's own workaround is Image.open's formats parameter, which open_checked sets from the policy.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_an_unknown_format

How to protect yourself

In general. Upgrade to Pillow 12.2.0.

Specifically. Open with formats limited to the readers you mean to use, as open_checked does.

The general advice applies to every row here.

Sources

• https://osv.dev/vulnerability/GHSA-whj4-6x5x-4v2j
• https://osv.dev/vulnerability/PYSEC-2026-2250
• The record entry, triaged 2026-11-03, last checked 2026-11-03