What’s Vulnerable › Vulnerabilities
CVE-2021-23437: Regular Expression Denial of Service (ReDoS)
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-09-03 · updated 2026-06-17
- Weakness: CWE-125
Description
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Affected products
- Fedoraproject Fedora: 33, 34
- python-pillow Pillow: from 5.2.0 before 8.3.2 — fixed in 8.3.2
- Pypi Pillow: before 8.3.2; 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+76) — fixed in 8.3.2
How to fix
Upgrade to a fixed version: python-pillow Pillow 8.3.2; Pypi Pillow 8.3.2. Check the vendor advisory for mitigations.
References
- https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/
- https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html
- https://security.gentoo.org/glsa/202211-10
- https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443
- https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/
- https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html
Get alerted when CVE-2021-23437 or the next vulnerability affects your stack