{"id":"ghsa-ghsa-g4qv-2jxx-769h","seq":309589,"kind":"advisory","title":"Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","url":"https://github.com/advisories/GHSA-g4qv-2jxx-769h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-g4qv-2jxx-769h","summary":"影響: pip:Pillow >= 11.0.0, < 13.0.0 → 13.0.0\nA PNG file with a large eXIf chunk full of repeated 6-byte markers makes Pillow's EXIF parser take seconds of CPU instead of milliseconds. The cost grows with the square of the chunk size, so a normal small-photo-sized file is enough to cause real delay. ### Details Exif.load() in src/PIL/Image.py strips a marker from the start of the EXIF data like this: python while data and data.startswith(b\"Exif\\x00\\x00\"): data = data[6:] Each pass makes a new copy of the remaining data. A real camera write…","severity":"high","techs":["python"],"cves":["CVE-2026-96643"],"tags":["GHSA-g4qv-2jxx-769h","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:02:39.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}