These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-55380 is a HIGH severity vulnerability in Pillow, a Python imaging library. The issue arises from the library's handling of GD 2.x image files, which can lead to excessive C-heap allocation when loading crafted .gd files. This vulnerability is fixed in Pillow version 12.3.0. The vulnerability exists in the GdImageFile._open() method of Pillow's GdImageFile.py, where image dimensions are read from [truncated]
CVE-2026-55379 is a high-severity vulnerability in Pillow, a Python imaging library. The issue arises from the library's handling of BDF font files, specifically in the `bdf_char()` function of `PIL/BdfFontFile.py`. Prior to version 12.3.0, this function reads the BBX width and height fields from a BDF font file and passes attacker-controlled dimensions to `Image.new()` without calling `Image._decompressi [truncated]
CVE-2026-54059 is a HIGH severity vulnerability in Pillow, a Python imaging library. The issue arises from the _load_bitmaps() function in PcfFontFile.py, which reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(). This allows crafted PCF font data to cause excessive memory allocation. The vulnerability is fixed [truncated]
CVE-2026-1502 describes a CR/LF handling flaw where bytes were not rejected in HTTP client proxy tunnel headers or host values. In practical terms, that kind of validation gap can let attacker-controlled input alter outbound request formatting in proxy-related flows. The supplied references point to CPython fixes and a Python security announcement, while the NVD snapshot is still marked "Awaiting Analysis."
CVE-2025-13836 is a medium-severity Python vulnerability in HTTP response handling. If a client reads a response without specifying a size, the default behavior uses Content-Length. A malicious server can abuse that behavior by advertising a very large value and forcing the client to read excessive data into memory, which can lead to out-of-memory conditions or denial of service.
CVE-2017-5992 describes a server-side or desktop impact risk in workflows that parse untrusted Excel files with openpyxl 2.4.1. The issue is an XML external entity (XXE) weakness: a crafted .xlsx document can trigger external entity resolution and expose data or affect availability. Because exploitation depends on a user or process opening a malicious file, the practical risk is highest anywhere spreadshe [truncated]