CVE-2026-112401

A flaw was found in Pillow. When parsing GIF images with numerous comment blocks, the library repeatedly copies data in an inefficient manner. A remote attacker can exploit this vulnerability by submitting a specially crafted GIF image to an application that processes images using Pillow, causing excessive CPU consumption and leading to a Denial of Service (DoS).

This vulnerability is rated Moderate severity because exploitation can exhaust worker CPU resources and trigger application unresponsiveness without compromising data confidentiality, integrity, or permitting arbitrary code execution. In Red Hat environments, Pillow is utilized across containerized workloads, machine learning pipelines, and automation platforms to process multimedia inputs. Because the algorithmic delay is restricted to the specific worker thread or container handling the untrusted image, broader platform stability is typically preserved by standard request timeouts and concurrency limits.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.