Red Hat Product Errata RHSA-2026:39127 - Security Advisory
Issued:
2026-07-14
Updated:
2026-07-14

RHSA-2026:39127 - Security Advisory

Synopsis

Important: python-pillow security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python-pillow is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
  • python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
  • python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
  • python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x

Fixes

  • BZ - 2497452 - CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file
  • BZ - 2497455 - CVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image file
  • BZ - 2497464 - CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data
  • BZ - 2497466 - CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files

Red Hat Enterprise Linux for x86_64 8

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
x86_64
python-pillow-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 1544b0f282f6aae5c670a57c7bdc23dc90736db20e87fadcadec770521a09531
python-pillow-debugsource-5.1.1-22.el8_10.x86_64.rpm SHA-256: d82fd5b37bdd2e59290908c0cd24b4995a4b1fb6485c7e0c6c1df0feaabe5dc6
python3-pillow-5.1.1-22.el8_10.x86_64.rpm SHA-256: 31c9c1d3f7075abe2a7cbc6e4ccd91b3bc82c3adacd9d5a5fbb8bf5cb2372518
python3-pillow-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 519d716b7668d0d2c191defdd5850aff40aebca6c6d6d91d4050a574b9b54c50
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 7a988a84e5a4e5dbff7dcdcedbc90237563d41937b566636f2a01d5f7053aa98

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
s390x
python-pillow-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: 5e6339076d00d5a925422066a76fb8c1138d0b97078cb1f39a2ec3f5e434f7bf
python-pillow-debugsource-5.1.1-22.el8_10.s390x.rpm SHA-256: a17fc33d2843dbb493d84f743ddea3e02d2b4203b8f638832e4997b8ddafa29e
python3-pillow-5.1.1-22.el8_10.s390x.rpm SHA-256: a67801010343a9eef41b7fe4c7661e5715c29f7aa42701d713438ce63dc8bea0
python3-pillow-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: 5aa3a4960a83fc437b803d76ab95222ab5b8da3ef21eea9c8edb2e675a0e10a8
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: decec322365812962538d6dbe3aca6745908608d74793eadce120cacbfad013a

Red Hat Enterprise Linux for Power, little endian 8

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
ppc64le
python-pillow-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 30daa6ef1cd8f16b43be56ae8aa76184f98fb8814e3f1d3e8c61aec825b4068c
python-pillow-debugsource-5.1.1-22.el8_10.ppc64le.rpm SHA-256: b53ae0f5319a9ebd36b6a74c21a8c0577539101f26afe11750708ab868ed4c30
python3-pillow-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 90436eadd3697eceec8902ca17a9148a53e972335611eb4b648729fe55c2fffb
python3-pillow-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 42df1068f061d59a2d52efb38bbf20673eff80735507962bb555e80fc75f18bc
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 133ce0b4e7ae6d0329dfb83c2e311fd72b6490b6ae9465a9b269ef22cb3e67bd

Red Hat Enterprise Linux for ARM 64 8

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
aarch64
python-pillow-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: a7816bc597cc491af876192019352c6a43c12e31e9a442cc024e1f7519257593
python-pillow-debugsource-5.1.1-22.el8_10.aarch64.rpm SHA-256: 172891ef6a4b499025d2f087853cbfac38b82c00a74e8fdcc1864cb66a787610
python3-pillow-5.1.1-22.el8_10.aarch64.rpm SHA-256: 51430605ba325c447552da43f1b428e8cad6022be0639368ca4ae182f75b9881
python3-pillow-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: 5ba0477ff3b35af268812eb9a5125887742ef2607743a6197dc4b2bea22653d7
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: 91d0a9cbec1e86a5f2ffe7d03ec5d988c51b68a4972e0c3521eb481cb10f7751

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
python-pillow-debuginfo-5.1.1-22.el8_10.i686.rpm SHA-256: c87767aaa10c814a1e89a8e72d02c62d8ba11f7e362ee79238bdf57fff84452e
python-pillow-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 1544b0f282f6aae5c670a57c7bdc23dc90736db20e87fadcadec770521a09531
python-pillow-debugsource-5.1.1-22.el8_10.i686.rpm SHA-256: d7fcf013849d0a5d8105913b30f408d9b71d26cd9173b94eb0125a7ae276005f
python-pillow-debugsource-5.1.1-22.el8_10.x86_64.rpm SHA-256: d82fd5b37bdd2e59290908c0cd24b4995a4b1fb6485c7e0c6c1df0feaabe5dc6
python3-pillow-5.1.1-22.el8_10.i686.rpm SHA-256: 31e3940ae6c5c2aae5931231e0bf91232c11b4c98de4295ae93a1d7e05aa8f2e
python3-pillow-debuginfo-5.1.1-22.el8_10.i686.rpm SHA-256: 71f63c2dd3b0ca9c091525546afad0f73f37ed5c7190268bc6b4cc6bf86b8b8e
python3-pillow-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 519d716b7668d0d2c191defdd5850aff40aebca6c6d6d91d4050a574b9b54c50
python3-pillow-devel-5.1.1-22.el8_10.i686.rpm SHA-256: 6307ddc87740528a47ba998c0bde51f008c1092f74ca87761acab2c6e817f1b4
python3-pillow-devel-5.1.1-22.el8_10.x86_64.rpm SHA-256: 7ce8753b3077b18f844642c4dc4c14f0f5a6364709e8d8a8bfce9e29a327e00c
python3-pillow-doc-5.1.1-22.el8_10.noarch.rpm SHA-256: 6ff1fc0c4ea6eec9ecb1d3aa6376cdec201491dc04b34505136f6d0643a95d05
python3-pillow-tk-5.1.1-22.el8_10.x86_64.rpm SHA-256: 85468734ef73e0c21b6c0b6436d2f431e962082ce4055c176042757224f6e632
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.i686.rpm SHA-256: 93e78dc2e235ae0a0d87bca0d28a2ac6948835066bbb9b003336afd33dd6c413
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 7a988a84e5a4e5dbff7dcdcedbc90237563d41937b566636f2a01d5f7053aa98

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
python-pillow-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 30daa6ef1cd8f16b43be56ae8aa76184f98fb8814e3f1d3e8c61aec825b4068c
python-pillow-debugsource-5.1.1-22.el8_10.ppc64le.rpm SHA-256: b53ae0f5319a9ebd36b6a74c21a8c0577539101f26afe11750708ab868ed4c30
python3-pillow-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 42df1068f061d59a2d52efb38bbf20673eff80735507962bb555e80fc75f18bc
python3-pillow-devel-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 822c906708d1708a42da644633bcb40fb0574affe7204027bd0d726d88879971
python3-pillow-doc-5.1.1-22.el8_10.noarch.rpm SHA-256: 6ff1fc0c4ea6eec9ecb1d3aa6376cdec201491dc04b34505136f6d0643a95d05
python3-pillow-tk-5.1.1-22.el8_10.ppc64le.rpm SHA-256: b675f355e01b742a1c802afe914b0b77ed64d682dd7b94f12717c1b6e90fd4fb
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 133ce0b4e7ae6d0329dfb83c2e311fd72b6490b6ae9465a9b269ef22cb3e67bd

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
python-pillow-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: a7816bc597cc491af876192019352c6a43c12e31e9a442cc024e1f7519257593
python-pillow-debugsource-5.1.1-22.el8_10.aarch64.rpm SHA-256: 172891ef6a4b499025d2f087853cbfac38b82c00a74e8fdcc1864cb66a787610
python3-pillow-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: 5ba0477ff3b35af268812eb9a5125887742ef2607743a6197dc4b2bea22653d7
python3-pillow-devel-5.1.1-22.el8_10.aarch64.rpm SHA-256: c0d5d0dbb152bef2f3ed6ec946aa916377a2cd2d4a2a87b2144b27f7e062e198
python3-pillow-doc-5.1.1-22.el8_10.noarch.rpm SHA-256: 6ff1fc0c4ea6eec9ecb1d3aa6376cdec201491dc04b34505136f6d0643a95d05
python3-pillow-tk-5.1.1-22.el8_10.aarch64.rpm SHA-256: eeeb705208b55ccebadbe32b54772a14538f812ebd4fc294585da8fadb65d43b
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: 91d0a9cbec1e86a5f2ffe7d03ec5d988c51b68a4972e0c3521eb481cb10f7751

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
python-pillow-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: 5e6339076d00d5a925422066a76fb8c1138d0b97078cb1f39a2ec3f5e434f7bf
python-pillow-debugsource-5.1.1-22.el8_10.s390x.rpm SHA-256: a17fc33d2843dbb493d84f743ddea3e02d2b4203b8f638832e4997b8ddafa29e
python3-pillow-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: 5aa3a4960a83fc437b803d76ab95222ab5b8da3ef21eea9c8edb2e675a0e10a8
python3-pillow-devel-5.1.1-22.el8_10.s390x.rpm SHA-256: 9dd5098d2e2a3927ed4c57d66834d14283879b74f3baf28cab8285b4694dc1a5
python3-pillow-doc-5.1.1-22.el8_10.noarch.rpm SHA-256: 6ff1fc0c4ea6eec9ecb1d3aa6376cdec201491dc04b34505136f6d0643a95d05
python3-pillow-tk-5.1.1-22.el8_10.s390x.rpm SHA-256: 5fdd573c87d536a97dd7475ed0615cf2760f932a33539931221401d2c2825b46
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: decec322365812962538d6dbe3aca6745908608d74793eadce120cacbfad013a

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
x86_64
python-pillow-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 1544b0f282f6aae5c670a57c7bdc23dc90736db20e87fadcadec770521a09531
python-pillow-debugsource-5.1.1-22.el8_10.x86_64.rpm SHA-256: d82fd5b37bdd2e59290908c0cd24b4995a4b1fb6485c7e0c6c1df0feaabe5dc6
python3-pillow-5.1.1-22.el8_10.x86_64.rpm SHA-256: 31c9c1d3f7075abe2a7cbc6e4ccd91b3bc82c3adacd9d5a5fbb8bf5cb2372518
python3-pillow-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 519d716b7668d0d2c191defdd5850aff40aebca6c6d6d91d4050a574b9b54c50
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.x86_64.rpm SHA-256: 7a988a84e5a4e5dbff7dcdcedbc90237563d41937b566636f2a01d5f7053aa98

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
aarch64
python-pillow-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: a7816bc597cc491af876192019352c6a43c12e31e9a442cc024e1f7519257593
python-pillow-debugsource-5.1.1-22.el8_10.aarch64.rpm SHA-256: 172891ef6a4b499025d2f087853cbfac38b82c00a74e8fdcc1864cb66a787610
python3-pillow-5.1.1-22.el8_10.aarch64.rpm SHA-256: 51430605ba325c447552da43f1b428e8cad6022be0639368ca4ae182f75b9881
python3-pillow-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: 5ba0477ff3b35af268812eb9a5125887742ef2607743a6197dc4b2bea22653d7
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.aarch64.rpm SHA-256: 91d0a9cbec1e86a5f2ffe7d03ec5d988c51b68a4972e0c3521eb481cb10f7751

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
ppc64le
python-pillow-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 30daa6ef1cd8f16b43be56ae8aa76184f98fb8814e3f1d3e8c61aec825b4068c
python-pillow-debugsource-5.1.1-22.el8_10.ppc64le.rpm SHA-256: b53ae0f5319a9ebd36b6a74c21a8c0577539101f26afe11750708ab868ed4c30
python3-pillow-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 90436eadd3697eceec8902ca17a9148a53e972335611eb4b648729fe55c2fffb
python3-pillow-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 42df1068f061d59a2d52efb38bbf20673eff80735507962bb555e80fc75f18bc
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.ppc64le.rpm SHA-256: 133ce0b4e7ae6d0329dfb83c2e311fd72b6490b6ae9465a9b269ef22cb3e67bd

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10

SRPM
python-pillow-5.1.1-22.el8_10.src.rpm SHA-256: 6b515a2468f066ef5435af96cb3e7616a2a31262b453109ac41188efbdb94c2c
s390x
python-pillow-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: 5e6339076d00d5a925422066a76fb8c1138d0b97078cb1f39a2ec3f5e434f7bf
python-pillow-debugsource-5.1.1-22.el8_10.s390x.rpm SHA-256: a17fc33d2843dbb493d84f743ddea3e02d2b4203b8f638832e4997b8ddafa29e
python3-pillow-5.1.1-22.el8_10.s390x.rpm SHA-256: a67801010343a9eef41b7fe4c7661e5715c29f7aa42701d713438ce63dc8bea0
python3-pillow-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: 5aa3a4960a83fc437b803d76ab95222ab5b8da3ef21eea9c8edb2e675a0e10a8
python3-pillow-tk-debuginfo-5.1.1-22.el8_10.s390x.rpm SHA-256: decec322365812962538d6dbe3aca6745908608d74793eadce120cacbfad013a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.