Allocation of Resources Without Limits or Throttling Affecting pillow package, versions [2.3.0,13.0.0)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-PILLOW-21369600
- published21 Oct 2026
- disclosed20 Oct 2026
- creditUnknown
Introduced: 20 Oct 2026
NewCVE-2026-112899 (opens in a new tab)How to fix?
Upgrade Pillow to version 13.0.0 or higher.
Overview
Pillow is a PIL (Python Imaging Library) fork.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Ghostscript function in src/PIL/EpsImagePlugin.py, where a decompression bomb check is not applied before Ghostscript renders an EPS image. An attacker can supply an EPS file with dimensions that exceed the decompression bomb threshold, causing Pillow to invoke Ghostscript at an arbitrarily large resolution and then raise a DecompressionBombError when reopening the output file.
Note: DecompressionBombError fires only when Pillow reopens the Ghostscript output file, so Pillow's own in-process allocation stays bounded and there is no memory corruption.