---
schema_version: '1.0'
id: security-20260711-42df7e
url: https://osv.dev/vulnerability/GHSA-whj4-6x5x-4v2j
url_hash: 42df7ecec3c95eb8b068fd678f06482af4da845d27bca0b362681d064c0d4e82
canonical_url: https://osv.dev/vulnerability/GHSA-whj4-6x5x-4v2j
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-40192
- GHSA-whj4-6x5x-4v2j
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- pillow
- PyPI
lang: en
published_at: '2026-04-13T19:22:35Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:54Z'
status: published
content_hash: 68d5f1363ba3460933911076b6fe44e090e3d9d86723973377822a697e068e5f
license_note: full
summary: FITS GZIP decompression bomb in Pillow
summary_source: rss
summary_en: FITS GZIP decompression bomb in Pillow
entities:
- name: Monaco bomb suspect
  type: concept
key_facts: []
related: []
related_auto: []
title: 'CVE-2026-40192: FITS GZIP decompression bomb in Pillow'
---

# CVE-2026-40192: FITS GZIP decompression bomb in Pillow

## TL;DR
FITS GZIP decompression bomb in Pillow

## Key Points
- cve / CVE-2026-40192 / GHSA-whj4-6x5x-4v2j / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / pillow / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** GHSA-whj4-6x5x-4v2j (CVE-2026-40192)

**Affected (your watchlist):**
- `PyPI:pillow` 12.1.1 → fixed in 12.2.0 [docker/docker-llmwiki]

**Details:**
### Impact
Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

### Patches
The amount of data read is now limited to the necessary amount.
Fixed in Pillow 12.2.0 (PR #9521).

### Workarounds
Avoid Pillow >= 10.3.0, < 12.2.0
Only open [specific image formats](https://pillow.readthedocs.io/en/stable/releasenotes/8.0.0.html#image-open-add-formats-parameter), excluding FITS.

**References:**
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
- https://nvd.nist.gov/vuln/detail/CVE-2026-40192
- https://github.com/python-pillow/Pillow/pull/9521
- https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
- https://github.com/python-pillow/Pillow
- https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-whj4-6x5x-4v2j_

## Source
元記事: [CVE-2026-40192: FITS GZIP decompression bomb in Pillow](https://osv.dev/vulnerability/GHSA-whj4-6x5x-4v2j) — published 2026-04-13T19:22:35Z