[ALSA-2026:92639] Important: python-pillow security update
Type:
security
Severity:
important
Release date:
2026-10-30
Description:
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391) * pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402) * pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392) * pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397) * pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405) * pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894) * pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895) * pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406) * pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640) * pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 python3-pillow-devel-5.1.1-33.el8_10.aarch64.rpm 277dc9fd5618943a3d689679eb22ef14631280aa56171f36e4b947af64568d6d
aarch64 python3-pillow-tk-5.1.1-33.el8_10.aarch64.rpm 613b1da10aa1ee0587881719170a4aaa4b22c128f66f1b77da43dc7d50a928ea
aarch64 python3-pillow-5.1.1-33.el8_10.aarch64.rpm 7efdc285f72e624893b93779d1b028b1a0863120f78c85cb71272a6627a0d2c2
i686 python3-pillow-5.1.1-33.el8_10.i686.rpm c4b93c7d40d6ae1819210128ed27b9a333f4987925011c689f59c19fe790e12c
i686 python3-pillow-devel-5.1.1-33.el8_10.i686.rpm e2f6d4bf5a972854f506349c48183bab66481b5a522c941f1a087d750e871953
noarch python3-pillow-doc-5.1.1-33.el8_10.noarch.rpm 149e91005220a9891d610ee2a9f680ea13889a93303f0935d89e58a5c5510534
ppc64le python3-pillow-5.1.1-33.el8_10.ppc64le.rpm 2df3a7a452530a65b7397502850711bab0cbb8df6311f2e086ba837e3b54b455
ppc64le python3-pillow-devel-5.1.1-33.el8_10.ppc64le.rpm 2f649dbfcf2a88e8fd79aeaff3288e4cb8cbb37d1c43728b74846f54f3b80a93
ppc64le python3-pillow-tk-5.1.1-33.el8_10.ppc64le.rpm 84f4c2abb3c8a77cb1872684ecf14863c1822688a98de459f0e7a01b3a5aa909
s390x python3-pillow-devel-5.1.1-33.el8_10.s390x.rpm 072fc4d04265e3b2908292c9b9c88c9486f9d2d60023a1bd2008dfd0962028aa
s390x python3-pillow-tk-5.1.1-33.el8_10.s390x.rpm 5ca34f6fb207148e73ee209a9bde8698898f53e041380061d7ee9094a9778947
s390x python3-pillow-5.1.1-33.el8_10.s390x.rpm ad312b9d4bb63ce031bb16a086390b29ace3dcb3a8bb2679b3bcb59e7c7e8063
x86_64 python3-pillow-tk-5.1.1-33.el8_10.x86_64.rpm 0e7578af1563d3b72491bd95146841f5750f4543f207fafb1f0b78a3755fe3d8
x86_64 python3-pillow-5.1.1-33.el8_10.x86_64.rpm 1239e8d6e6125f66cb13ac3b4721a952346c7709a3ca73a84c6c56b5f91f097f
x86_64 python3-pillow-devel-5.1.1-33.el8_10.x86_64.rpm eaccc6637e9d109236b6a3d01fa5dbe2e14f99b1bde26907afb9107610d1c149
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.