CVE-2026-96638

Medium

Advisory

Published 21 Oct 2026In the index since 23 Oct 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.003; 19th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 251; of 18,232 indexed, latest versions
Container images: 235; deployed by those charts
Fix available: 1 of 2; affected packages

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Carried by container images the latest versions of 251 of 18,232 indexed charts deploy, on 235 images.

Affected package	Affected versions	Fixed in	Images
pillowpypi	9.1.0, 9.2.0, 9.3.0, 9.4.0+16 more	13.0.0	228
pillowdeb	5.1.0-1, 5.1.0-1ubuntu0.6, 5.1.0-1ubuntu0.7, 7.0.0-4ubuntu0.5+7 more	no fix listed	15

OSV records: DEBIAN-CVE-2026-96638 GHSA-24rc-8hj2-v98c UBUNTU-CVE-2026-96638
Trending: Rank 22 in indexed charts, since 24 Oct 2026. See the ranking →

Charts affected

251 by stars

Chart

Latest

Affected images

Radar Score

changedetection-iozekker6

1.104.0

1 of 1 See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry CVE-2026-96638.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.9	04eaae7915ba	pillow@12.3.0	13.0.0

Open the chart page →

3,129

Container images carrying it

235 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
bmeares/meerschaum :2.8.4	8e9c5bacaa82	pillow@11.1.0	13.0.0	1
bnjbvr/kresus :0.22.1	37e216b182c8	pillow@11.0.0	13.0.0	1
buntha/mlflow :2.1.1	154542cc3083	pillow@9.3.0	13.0.0	1
burakince/mlflow :3.16.0	ab4b566644b9	pillow@12.3.0	13.0.0	1
camerahub/camerahub :0.36.23	a5af37dd6e1b	pillow@9.5.0	13.0.0	1
camptocamp/geomapfishapp-geoportal :latest	3f916d5d2f62	pillow@12.3.0 pillow@10.2.0-1ubuntu1.3	13.0.0 no fix listed	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	pillow@12.2.0	13.0.0	1
copyparty/ac :1.19.20	0a0a8605062c	pillow@11.2.1	13.0.0	1
crocodilestick/calibre-web-automated :v4.0.6	c31a738b6d5e	pillow@12.1.0	13.0.0	1
datamate/seafile-professional :11.0.20	2dd66b722464	pillow@10.2.0	13.0.0	1
deconzcommunity/deconz :2.29.2	062de2362641	pillow@9.4.0-1.1+deb12u1 pillow@9.4.0	no fix listed 13.0.0	1
deconzcommunity/deconz :2.26.1	23c86008d73f	pillow@9.4.0-1.1+b1 pillow@9.4.0	no fix listed 13.0.0	1
dpage/pgadmin4 :7.5	37946e4f3e7b	pillow@9.5.0	13.0.0	1
dpage/pgadmin4 :9.11.0	50700ac17936	pillow@12.0.0	13.0.0	1
dpage/pgadmin4 :9.2	52cb72a9e3da	pillow@11.1.0	13.0.0	1
dpage/pgadmin4 :8.13	561c1f8f99f2	pillow@11.0.0	13.0.0	1
esphome/esphome :2026.10.0	3a32372dfbd6	pillow@12.3.0	13.0.0	1
esphome/esphome :2026.9.1	4ad55931c018	pillow@12.3.0	13.0.0	1
esphome/esphome :2024.3.0	9ab8cc88b28c	pillow@10.2.0	13.0.0	1
esphome/esphome :2024.12.2	b2c6322700ac	pillow@10.4.0	13.0.0	1
esphome/esphome :2025.3.0	def8b6e4f517	pillow@10.4.0	13.0.0	1
evk02/mlflow :2.2.1	ef6ff257ef35	pillow@9.4.0	13.0.0	1
factly/hunting :0.2.0-stagv1.2	ca5bc71d1d5c	pillow@9.3.0	13.0.0	1
galaxy/pulsar-kubernetes :0.15.7	e50a890e24c9	pillow@11.2.1	13.0.0	1
heartexlabs/label-studio :latest	afcc516a2277	pillow@12.3.0	13.0.0	1
homeassistant/home-assistant :2023.10.3	021e2afc6e57	pillow@10.0.1	13.0.0	1
homeassistant/home-assistant :2026.7	5a531753cea9	pillow@12.2.0	13.0.0	1
homeassistant/home-assistant :2023.12.4	8d000332b09b	pillow@10.1.0	13.0.0	1
homeassistant/home-assistant :2026.8.0	a21689ef0510	pillow@12.3.0	13.0.0	1
huginn/huginn :4df1217d3055db980a04f293e28016b77826e3ca	eab0db98264e	pillow@5.1.0-1ubuntu0.7	no fix listed	1
ilum/streamlit-example :1.0.0	ce5dcdeb22ba	pillow@12.0.0	13.0.0	1
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	pillow@11.0.0	13.0.0	1
inventree/inventree :1.6.1	7c1e251a6c52	pillow@11.1.0-5+deb13u4 pillow@11.1.0	no fix listed 13.0.0	1
kobotoolbox/kobocat :2.022.24a	b15679454415	pillow@9.1.0	13.0.0	1
kobotoolbox/kpi :2.022.24d	bcacc01bccd4	pillow@9.1.0	13.0.0	1
langgenius/dify-agent-backend :1.17.0	bdb2ed516bd3	pillow@12.3.0	13.0.0	1
langgenius/dify-api :1.0.0	066035f93856	pillow@11.1.0	13.0.0	1
langgenius/dify-api :1.17.0	52be6088dd84	pillow@12.3.0	13.0.0	1
langgenius/dify-api :0.6.11	fca918260dd6	pillow@10.3.0	13.0.0	1
linuxserver/bazarr :latest	fb0437897eaa	pillow@12.3.0	13.0.0	1
linuxserver/calibre-web :0.6.24	241009026e6f	pillow@11.3.0	13.0.0	1
linuxserver/deluge :libtorrentv1-2.2.0-ls40	052eac68ccc0	pillow@11.2.1	13.0.0	1
linuxserver/deluge :18.04.1	0ac871624394	pillow@5.1.0-1ubuntu0.6	no fix listed	1
linuxserver/deluge :version-2.0.3-2201906121747ubuntu18.04.1	2ce561a95e7b	pillow@5.1.0-1ubuntu0.6	no fix listed	1
linuxserver/deluge :2.2.0	bf306ddd5e6d	pillow@12.3.0	13.0.0	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pillow@12.1.1	13.0.0	1
loeken/home-assistant :2026.9.2	b1dff5b4c593	pillow@12.3.0	13.0.0	1
maponyacharles/sceptreai :mlflow-0.1.12	42d418654ebd	pillow@12.3.0	13.0.0	1
maponyacharles/sceptreai :api-0.1.12	7b37b092130a	pillow@12.3.0	13.0.0	1
mathesar/mathesar :0.12.0	091757cb01fe	pillow@12.1.1	13.0.0	1