Hi,

The following vulnerability was published for pillow.

CVE-2026-40192[0]:
| Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1
| did not limit the amount of GZIP-compressed data read when decoding
| a FITS image, making them vulnerable to decompression bomb attacks.
| A specially crafted FITS file could cause unbounded memory
| consumption, leading to denial of service (OOM crash or severe
| performance degradation). If users are unable to immediately
| upgrade, they should only open specific image formats, excluding
| FITS, as a workaround.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-40192
https://www.cve.org/CVERecord?id=CVE-2026-40192
[1] https://github.com/python-pillow/Pillow/pull/9521
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore