{"vulnerability": "CVE-2026-59200", "sightings": [{"uuid": "043ba9d8-16aa-43b0-8cbb-4caf528de267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59200", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565", "content": "", "creation_timestamp": "2026-07-21T00:35:14.879027Z"}, {"uuid": "5aa1a833-4421-4f76-8f9b-1ffd9f05bac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-59200", "type": "seen", "source": "https://gist.github.com/alon710/58614afe66c43fc333bb604ba1de657d", "content": "# CVE-2026-59200: CVE-2026-59200: Remote Denial of Service via PDF Decompression Bomb in Pillow\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59200\n\n## Summary\nCVE-2026-59200 is a high-severity uncontrolled resource consumption vulnerability in the Pillow Python Imaging Library. The flaw resides in the PDF stream decoder, allowing remote, unauthenticated attackers to trigger host out-of-memory crashes by submitting malicious PDF decompression bombs.\n\n## TL;DR\nUnbounded zlib decompression in Pillow's PDF parser allows remote attackers to cause system Out-of-Memory crashes using crafted PDF files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS**: 7.5\n- **EPSS Score**: 0.0035\n- **Impact**: High (Denial of Service)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow (python-pillow)\n\n## Mitigation\n\n- Upgrade Pillow to version 12.3.0 or higher to resolve the unbounded decompression logic.\n- Enforce explicit format constraints using Image.open(formats=[...]) to block the PDF parser from initiating auto-detection.\n- Configure operating system and container limits to bound application memory consumption.\n\n**Remediation Steps:**\n1. Check active Pillow versions in your environment using `pip show Pillow`.\n2. Update dependencies and requirements configuration to lock Pillow to `>=12.3.0`.\n3. Deploy container resource limits in Kubernetes or systemd configuration files to mitigate memory exhaustion blast-radius.\n\n## References\n\n- [Official Fix Commit](https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09)\n- [Pillow Pull Request #9718](https://github.com/python-pillow/Pillow/pull/9718)\n- [GitHub Security Advisory GHSA-jjj6-mw9f-p565](https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59200)\n- [Pillow Release Tag (12.3.0)](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n- [Wiz Vulnerability Analysis Database](https://www.wiz.io/vulnerability-database/cve/cve-2026-59200)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59200) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T09:31:09.630747Z"}]}