{"vulnerability": "CVE-2026-59200", "sightings": [{"uuid": "043ba9d8-16aa-43b0-8cbb-4caf528de267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59200", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565", "content": "", "creation_timestamp": "2026-07-21T00:35:14.879027Z"}, {"uuid": "5aa1a833-4421-4f76-8f9b-1ffd9f05bac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-59200", "type": "seen", "source": "https://gist.github.com/alon710/58614afe66c43fc333bb604ba1de657d", "content": "# CVE-2026-59200: CVE-2026-59200: Remote Denial of Service via PDF Decompression Bomb in Pillow\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59200\n\n## Summary\nCVE-2026-59200 is a high-severity uncontrolled resource consumption vulnerability in the Pillow Python Imaging Library. The flaw resides in the PDF stream decoder, allowing remote, unauthenticated attackers to trigger host out-of-memory crashes by submitting malicious PDF decompression bombs.\n\n## TL;DR\nUnbounded zlib decompression in Pillow's PDF parser allows remote attackers to cause system Out-of-Memory crashes using crafted PDF files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS**: 7.5\n- **EPSS Score**: 0.0035\n- **Impact**: High (Denial of Service)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow (python-pillow)\n\n## Mitigation\n\n- Upgrade Pillow to version 12.3.0 or higher to resolve the unbounded decompression logic.\n- Enforce explicit format constraints using Image.open(formats=[...]) to block the PDF parser from initiating auto-detection.\n- Configure operating system and container limits to bound application memory consumption.\n\n**Remediation Steps:**\n1. Check active Pillow versions in your environment using `pip show Pillow`.\n2. Update dependencies and requirements configuration to lock Pillow to `>=12.3.0`.\n3. Deploy container resource limits in Kubernetes or systemd configuration files to mitigate memory exhaustion blast-radius.\n\n## References\n\n- [Official Fix Commit](https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09)\n- [Pillow Pull Request #9718](https://github.com/python-pillow/Pillow/pull/9718)\n- [GitHub Security Advisory GHSA-jjj6-mw9f-p565](https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59200)\n- [Pillow Release Tag (12.3.0)](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n- [Wiz Vulnerability Analysis Database](https://www.wiz.io/vulnerability-database/cve/cve-2026-59200)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59200) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T09:31:09.630747Z"}, {"uuid": "75e2b9a2-450b-4dbf-8d4c-2b09198e69f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59200", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrari2btle2h", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59200 \u0432 Pillow: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043e\u0442 \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 PDF-\u0444\u0430\u0439\u043b\u044b\n\n\n\nhttps://kripta.biz/posts/C5C7DB50-439F-43C8-863D-7213B17CB517", "creation_timestamp": "2026-07-22T16:44:57.304163Z"}, {"uuid": "b6c23ff0-2644-4410-9641-8e2ec3c4b85f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59200", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrariji2op2m", "content": "\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05e7\u05e9\u05d4 \u05d1\u05e4\u05d9\u05d9\u05dc\u05d5\u05d8: CVE-2026-59200 - \u05d4\u05ea\u05e7\u05e4\u05ea \u05d3\u05d7\u05d9\u05e1\u05d4 \u05d7\u05e8\u05d9\u05d2\u05d4 \u05e9\u05d2\u05d5\u05e8\u05de\u05ea \u05dc-DoS\n\n\n\nhttps://khesef.xyz/posts/D71359A7-6D08-41D4-8571-D7452ADF1C27", "creation_timestamp": "2026-07-22T16:45:13.246987Z"}]}