{"id":"ghsa-ghsa-g842-9rc4-69pw","seq":309595,"kind":"advisory","title":"Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS","url":"https://github.com/advisories/GHSA-g842-9rc4-69pw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-g842-9rc4-69pw","summary":"影響: pip:pillow < 13.0.0 → 13.0.0\nSpiderImagePlugin's seek() bypasses the decompression bomb check, allowing a tiny ( DecompressionBombWarning fires correctly. - BYPASS: Image.open(stack, frame0=1x1) passes; im.seek(1) sets size (100,100) with NO DecompressionBombWarning/Error -> the check is bypassed. Real-world impact: a large frame-1 nsam/nrow (e.g. 40000x40000) causes im.load() to allocate ~6.4 GB (mode F) with the bomb check fully bypassed, from a file under 1 KB. Suggested fix Call Image._decompression_bomb_check(self.siz…","severity":"high","techs":["python"],"cves":["CVE-2026-96637"],"tags":["GHSA-g842-9rc4-69pw","pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T15:57:17.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}