TI-2026-42349 CVE-2026-59204 · GHSA-vjc4-5qp5-m44j
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Priority HIGH 77
Pillow is a Python imaging library.
RHSA-2026:52968
Red Hat Quay 3.12.21
Released 2026-08-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
Fixes 17 records
TI-2026-42344 CVE-2026-59197 · GHSA-xj96-63gp-2gmr
Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Priority HIGH 75
Pillow is a Python imaging library.
TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-42350 CVE-2026-59205 · GHSA-9hw9-ch79-4vh6
Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-42347 CVE-2026-59200 · GHSA-jjj6-mw9f-p565
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-42346 CVE-2026-59199 · GHSA-6r8x-57c9-28j4
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39958 CVE-2026-55380 · GHSA-phj9-mv4w-65pm
Pillow GdImageFile decompression bomb protection bypass
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39957 CVE-2026-55379 · GHSA-45hq-cxwh-f6vc
Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb…
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38994 CVE-2026-54060 · GHSA-5x94-69rx-g8h2
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38992 CVE-2026-54058 · GHSA-62p4-gmf7-7g93
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Priority HIGH 69
Pillow is a Python imaging library.
TI-2026-42699 CVE-2026-59885 · GHSA-8ppf-4f7h-5ppj
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Priority MEDIUM 40
pyasn1 is a generic ASN.1 library for Python.
TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp
Uncontrolled resource consumption in juliangruber brace-expansion
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.
TI-2026-42700 CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Priority LOW 39
pyasn1 is a generic ASN.1 library for Python.
TI-2026-28704 CVE-2026-39822 · GHSA-xcgv-8mv7-v8c7
Root escape via symlink plus trailing slash in os
Priority LOW 36
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.
TI-2026-41169 CVE-2026-57231 · GHSA-4hq8-gpf5-8p68
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
Priority LOW 33
Podman is a tool for managing OCI containers and pods.
TI-2026-13341 CVE-2026-15927 · GHSA-9rpm-rwwc-xw43
Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
Priority LOW 31
A flaw was found in Red Hat Quay's repository-level mirror configuration feature.