Regular Expression Denial of Service Vulnerability in Pillow Python Imaging Library
CVE-2026-112901

6.9MEDIUM

Key Information:

Vendor

Python-pillow

Status
Pillow
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112901?

The Pillow library, a widely-used Python imaging library, contains a vulnerability in its XBM header parser that can lead to denial of service. When an application attempts to open a specially crafted XBM file using the Image.open() method, the XbmImagePlugin applies a backtracking regular expression to the file's header. This process can stall the worker thread for an extended period, potentially minutes, thus affecting the application’s responsiveness. This vulnerability can be exploited if a malicious actor provides a specially crafted XBM file. This issue is resolved in version 13.0.0, which is crucial for users to upgrade to in order to maintain security.

Affected Version(s)

Pillow < 13.0.0

References

https://github.com/python-pillow/Pillow/security/advisori...
x_refsource_CONFIRM
https://github.com/python-pillow/Pillow/commit/2852a3e3d5...
x_refsource_MISC
https://github.com/python-pillow/Pillow/releases/tag/13.0.0
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.