{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ac61c9f6-d4b8-5ae8-8a54-991dcdd7cf00", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "version": "9.4.0.post8+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2b9ea73f-664a-5da2-92dc-456267bb4040", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "code_not_present" } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7c4394e4-bee2-5c67-9603-0d0ca30bc13b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "code_not_present" } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:090a683f-35c4-506b-bae7-af31da5df6de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22817 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:26ba51b8-f066-5a25-98b6-cc5559693434", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-24303 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:841affd1-4dc4-5155-a57c-4e84186b0fe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-45198 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a3b312ef-c92f-5548-90b0-f9d2c962380a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2db33e64-1514-54f1-8605-3cb25d183da9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7a023249-ec5b-5478-aec7-dc5f98c80bfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d9035a69-f557-5707-801a-0dc51ebd95b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:23b356a3-1cab-51aa-a8a3-0c5c265f647b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48379 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:504adf9d-6fce-5d73-b0c2-0ef2b96375b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:80cb6314-f232-5947-919d-c0e1ecefbae9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c38108ad-2190-5958-80f1-8d3a680abd8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e240f456-3833-5877-8d96-53cd2efbfd79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:09bd6c50-88ea-513d-85f5-a13eec92055f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:747d16a1-6c54-5ffd-80b0-eb69c5b781b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a8728abd-d61d-54f6-9dc8-8c87343dfb7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:3d140f7d-2452-5d17-885c-bd59f40c0cbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:977f5f1a-7c95-574f-b722-42f8e0deebf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:946b64bd-3348-57fa-8b54-86160b032644", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c95b7468-c1d7-53d5-8eec-d1aafb97dc0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a5fa9977-0dc4-5439-ab93-25c09b95fca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b9b0213e-1cf5-5e8b-ba79-a9cae5bd0bb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:22cf424f-d441-5178-a2b3-2ab8bbf7f0eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:5aaa1a57-d352-51ca-bbbe-bcdf7f90bb87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112405", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:80a25bb9-f6be-5855-a6e0-9c1a575cfd16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112405 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6d7e5e47-2622-55b4-8d46-e54e8b6fc6dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f193b2a5-b43b-5410-994b-42c32ae39c44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f8e694d6-b6a4-5fda-8b61-310cc7e4428a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:cfcdd2e9-36c6-5ec4-a4dd-fdc3483a4069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:811afa1d-338b-578f-99d2-602f2e5d7059", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:9a54824e-d166-5f83-87ca-fc0bae45afdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d13a0151-fc53-5129-8150-9e1937014cd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:99e7c7d9-9b03-525e-9fe3-683c94cc8609", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:49e84a5e-8c9a-54a9-9771-fad8c1bc39b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:3587871c-d6b1-56c7-83f4-b1571d66ac0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ee419635-8979-5f44-b5d9-a0ea602b1fa7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:db5b8fbc-4fd8-5181-938e-dcf4aadf8b99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:420d9ad7-2099-5f4a-93dc-593568322448", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e22b5c06-edaa-5aa0-9bf5-91eb7b7f4bb5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6a429581-0878-5ebd-b275-570f3ee4b8c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25990 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:dc1f08b2-fa90-5f38-8bc6-038d83f3a7e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40192 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:02559b00-3ac0-573e-a7c5-4f661348bc25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2366121e-a966-5437-aaa2-1f9df0e12249", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "code_not_present" } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1aecc7d9-d15e-5761-8e48-d44cb4022e5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c4c59099-9a16-5272-b12f-922ba550ce1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42311 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7759f848-8782-5f29-bea3-f4e12ded7ecc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:354fb0ce-b344-57f6-aebe-c9055732c0d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:778cfc1f-1cf6-5af8-a6b9-a3de291598ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:04294597-d404-5611-86a6-8d95a0dbb556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:046bcb54-ca3e-5712-ad87-17d0bed2b8a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7e39d8e0-c8a3-5ca8-bfea-61143db7569b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:0d3b9f5d-6b0c-52c5-91b9-57417d18f75a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b7d3832f-eabe-5461-bf0c-3884ad9efc14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1fd34cff-b053-5321-9dd1-00e0c1ab2b30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:77f6dd5f-a575-55b7-a885-4366f0947116", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:78d39901-c2a5-5c31-9de9-6601dcd3ac7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:89003196-fba8-5cd9-9ae5-15cbbb250d33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:bff85565-834d-5746-9560-8c31b49f49d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7932ffb7-c894-5c4f-8402-52066d9d41ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8035ccf3-10cf-5fa4-a98c-69e91275367c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7ef86f9c-9c88-55b2-b5bc-441e2e66c63e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7641f043-dd6b-5f25-b22a-efc53f4bc169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:09cc2287-9399-50bd-8990-216dad47d986", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e0859213-543b-59d7-8e08-b42a7c989d74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:bb3bb0d8-bc44-53ba-83d0-6dc5db2c9c72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:be5fe2c4-0405-55e6-abe2-3e5fa2b3a901", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8a080092-1ca1-5796-aaae-528a3ca6cceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:9287ad98-4033-5876-81b4-bb2992ee6113", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "code_not_present" } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f0ed45ee-c0ec-5e7c-9d09-c5cf0aa0c5e1", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6b974b03-c43e-5658-97b5-454415eeeb19", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post8+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ] }