CVE-2026-112901
published 2026-10-19CVE-2026-112901: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open…
PriorityP339medium6.9CVSS 4.0
AVNACLATNPRNUINVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.42%
35.8th percentile
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0.
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform | automation-dashboard-rhel9 | — | — |
| exploit-intelligence | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| lightspeed-services-ocp | ocp-rules-rhel9 | — | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| python-pillow | pillow | < 13.0.0 | 13.0.0 |
| python | pillow | >= 0 < 13.0.0 | 13.0.0 |
| quay | quay-rhel8 | — | — |
| quay | quay-rhel9 | — | — |
| rhai-early-access | docling-sdk-cuda-rhel9 | — | — |
| rhai-early-access | docling-serve-cuda-rhel9 | — | — |
| rhai | guidellm-rhel9 | — | — |
| rhaii | model-opt-cuda-rhel9 | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
ghsa·2026-10-21
CVE-2026-112901 [MEDIUM] CWE-1333 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
```
ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
```
A crafted 512-byte file makes Pillow's `Image.open()` spend about six minutes of processor time on one core before it gives up with `UnidentifiedImageError`. Anyone who can hand bytes to an application that opens images with Pillow's default settings can trigger this, for example through an upload form, a thumbnailer, or a service that checks whether a blob is an image. A few such files sent at once can tie up a typical pool of worker processes.
The cause is the `xbm_head` regular expression in `src/PIL/XbmImagePlugin.py:
VulDB
python-pillow Pillow up to 12.x XBM header parser XbmImageFile._open denial of service
vuldb·2026-10-20·CVSS 6.9
CVE-2026-112901 [MEDIUM] python-pillow Pillow up to 12.x XBM header parser XbmImageFile._open denial of service
A vulnerability was found in python-pillow Pillow up to 12.x. It has been classified as problematic. Affected is the function XbmImageFile._open of the component XBM header parser. Performing a manipulation results in denial of service.
This vulnerability was named CVE-2026-112901. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
Red Hat
pillow: Pillow: Denial of Service via crafted XBM image header
vendor_redhat·2026-10-19·CVSS 6.9
CVE-2026-112901 [MEDIUM] CWE-1333 pillow: Pillow: Denial of Service via crafted XBM image header
pillow: Pillow: Denial of Service via crafted XBM image header
A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted XBM (X BitMap) image file. When the application parses the image header, an inefficient regular expression causes excessive computational backtracking, stalling worker processes and leaving the service unresponsive.
Package: exploit-intelligence/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cpu-rhel9 (Lightspeed Core) - Fix deferred
Package: lightspeed-core/rag-tool-cuda-12.9-rhel9 (Lightspeed Core) - Fix deferred
Package: openshift-lightspeed/lightspeed-ocp-rag-rhel9
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-19
Published