Pillow GZIP Decompression Bomb Vulnerability in FITS Image Processing

A denial-of-service vulnerability has been identified in the Python imaging library Pillow, specifically in versions 10.3.0 prior to 12.2.0. The issue arises from the library's FITS image decoder, which did not restrict the amount of GZIP-compressed data read. This oversight made it possible for a specially crafted FITS file to cause unlimited memory consumption, leading to out-of-memory crashes or significant performance issues.

Impact

Exploitation of this vulnerability could result in unbounded memory usage, causing out-of-memory crashes or severe performance degradation.

Remediation

Users can upgrade to Pillow version 12.2.0 or later to address this vulnerability. If an immediate upgrade is not possible, it is recommended to avoid opening FITS files and to restrict image processing to other formats.