Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

Fedora 43 python-pillow Critical Denial of Service CVEs 2026-fc2ded926e

fedora
Calendar Grey July 20, 2026
Scroller Fedora
Fix critical issues including denial of service in python-pillow with Fedora 43 update. Address multiple CVEs.
Backport fixes for CVE-2026-59197 and CVE-2026-54058

Summary

Python image processing library, fork of the Python Imaging Library (PIL)

This library provides extensive file format support, an efficient

internal representation, and powerful image processing capabilities.

There are four subpackages: tk (tk interface), qt (PIL image wrapper for Qt),

devel (development) and doc (documentation).

Update Information:

Backport fixes for CVE-2026-59197 and CVE-2026-54058. Fix CVE-2026-55380, CVE-2026-54060, CVE-2026-54059, CVE-2026-55379, CVE-2026-55798

Topics%20covered

Topics Covered

security advisory denial of service fedora critical update advisory python-pillow

Change Log

* Sun Jul 19 2026 Sandro Mani - 11.3.0-10 - Backport fixes for CVE-2026-59197 and CVE-2026-54058 * Tue Jul 7 2026 Sandro Mani - 11.3.0-9 - Backport fixes for CVE-2026-55380, CVE-2026-54060, CVE-2026-54059, CVE-2026-55379, CVE-2026-55798

References


[ 1 ] Bug #2497649 - CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2497649 [ 2 ] Bug #2497660 - CVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2497660 [ 3 ] Bug #2497665 - CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2497665 [ 4 ] Bug #2497682 - CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2497682 [ 5 ] Bug #2497699 - CVE-2026-55798 python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2497699 [ 6 ] Bug #2501494 - CVE-2026-59197...

Read the Full Advisory

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-fc2ded926e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: python-pillow
Product: Fedora 43
Version: 11.3.0
Release: 10.fc43
URL: http://python-pillow.github.io/
Summary: Python image processing library

Topics%20covered

Topics Covered

security advisory denial of service fedora critical update advisory python-pillow

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.