Resource exhaustion in Pillow - CVE-2026-59200
Published: July 7, 2026
Vulnerability identifier: #VU137009
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-59200
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Alex Clark and Contributors
Affected software:
Pillow
Pillow
Detailed vulnerability description
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in PdfParser.PdfStream.decode() in Pillow's PdfParser.py when parsing a crafted FlateDecode-compressed PDF stream. A remote attacker can submit a specially crafted PDF file to cause a denial of service.
The issue occurs because zlib.decompress() is called with the PDF stream Length or DL value as an initial buffer hint without limiting the actual decompressed output size.
How to mitigate CVE-2026-59200
Install security update from vendor's website.