CVE-2026-55379

Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Python Python-pillow

Products

Pillow Pillow

CVE-2025-13462

tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Python

Products

Cpython Python

CVE-2026-5713

Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Python

Products

Cpython

CVE-2016-2183

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

CVSS 3.1 · 7.5 High EPSS 94.7% KEV · Not listed

Vendors

Cisco Nodejs Openssl and 3 more

Products

Content Security Management Appliance Node.js Openssl and 11 more

CVE-2026-42311

Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Python Python-pillow

Products

Pillow Pillow

CVE-2026-44431

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Python Urllib3

Products

Urllib3 Urllib3

CVE-2026-42310

Pillow: PDF Parsing Trailer Infinite Loop (DoS)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Python Python-pillow

Products

Pillow Pillow

CVE-2026-42309

Pillow: Heap buffer overflow with nested list coordinates

Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Python Python-pillow

Products

Pillow Pillow

CVE-2026-42308

Pillow: Integer overflow when processing fonts

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Python Python-pillow

Products

Pillow Pillow

CVE-2023-27043

python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Fedoraproject Netapp Python and 1 more

Products

Fedora Active Iq Unified Manager Ontap Select Deploy Administration Utility and 4 more

CVE-2026-25990

Pillow has an out-of-bounds write when loading PSD images

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Python Python-pillow

Products

Pillow Pillow

CVE-2008-3143

python: Multiple integer overflows discovered by Google

Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _struct.c, (4) arraymodule.c, (5) audioop.c, (6) binascii.c, (7) cPickle.c, (8) cStringIO.c, (9) cjkcodecs/multibytecodec.c, (10) datetimemodule.c, (11) md5.c, (12) rgbimgmodule.c, and (13) stropmodule.c in Modules/; (14) bufferobject.c, (15) listobject.c, and (16) obmalloc.c in Objects/; (17) Parser/node.c; and (18) asdl.c, (19) ast.c, (20) bltinmodule.c, and (21) compile.c in Python/, as addressed by "checks for integer overflows, contributed by Google."

CVSS 2.0 · 7.5 High EPSS 3.1% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux

CVE-2007-4559

python: tarfile module directory traversal

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux Rhel Eus and 1 more

CVE-2008-3142

python: Multiple buffer overflows in unicode processing

Multiple buffer overflows in Python 2.5.2 and earlier on 32bit platforms allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a long string that leads to incorrect memory allocation during Unicode string processing, related to the unicode_resize function and the PyMem_RESIZE macro.

CVSS 2.0 · 7.5 High EPSS 4.5% KEV · Not listed

Vendors

Canonical Debian Python and 1 more

Products

Ubuntu Linux Debian Linux Python and 1 more

CVE-2008-2316

python: integer overflow in hashlib module

Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed

Vendors

Python

Products

Python

CVE-2007-2052

python off-by-one locale.strxfrm() (possible memory disclosure)

Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.

CVSS 2.0 · 5.0 Medium EPSS 14.1% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux Network Satellite

CVE-2008-2315

python: Multiple integer overflows in python core

Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules. NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux

CVE-2006-4980

python repr unicode buffer overflow

Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via crafted wide character UTF-32/UCS-4 strings to certain scripts.

CVSS 2.0 · 7.5 High EPSS 5.6% KEV · Not listed

Vendors

Python Redhat

Products

Python Enterprise Linux Network Satellite

CVE-2008-1887

python: PyString_FromStringAndSize does not check for negative size values

Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStringAndSize function, which allocates less memory than expected when assert() is disabled and triggers a buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 6.3% KEV · Not listed

Vendors

Canonical Debian Python and 1 more

Products

Ubuntu Linux Debian Linux Python and 1 more

CVE-2009-3720

expat: buffer over-read and crash on XML with malformed UTF-8 sequences

The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.

CVSS 2.0 · 5.0 Medium EPSS 27.9% KEV · Not listed

Vendors

Apache Libexpat Project Python and 1 more

Products

Http Server Libexpat Python and 4 more