Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading · CVE-2026-55379 · GitHub Advisory Database · GitHub

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

High severity GitHub Reviewed Published Jul 3, 2026 in python-pillow/Pillow

0 Open 0 Closed

No open alerts for this advisory

Give feedback on Dependabot alerts