CVE-2026-116177: Python Pil Decompression Bomb Guard Disabledcve-2026-116177-python-pil-decompression-bomb-guard-disabled
Pillow's decompression-bomb guard is globally disabled by assigning None to Image.MAX_IMAGE_PIXELS. This mutates process-wide PIL state (typically as a module-import side effect), so every later decode of untrusted image bytes -- e.g. Image.open(<request bytes>).load() on media submitted to an API endpoint -- allocates the full raster declared in the image h
