{ "@id": "urn:uuid:fca9acad-0906-4010-a6c1-27b26890fa89", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T22:40:38.548237+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post16+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post16+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post16+tuxcare of pillow." } ] }