What’s Vulnerable › Vulnerabilities
CVE-2021-28677: Uncontrolled Resource Consumption in Pillow
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-06-02 · updated 2026-06-17
Description
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Affected products
- Fedoraproject Fedora: 33
- python-pillow Pillow: before 8.2.0 — fixed in 8.2.0
- Pypi Pillow: before 8.2.0; 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+73) — fixed in 8.2.0
How to fix
Upgrade to a fixed version: python-pillow Pillow 8.2.0; Pypi Pillow 8.2.0. Check the vendor advisory for mitigations.
References
- https://github.com/python-pillow/Pillow/pull/5377
- https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
- https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open
- https://security.gentoo.org/glsa/202107-33
- https://github.com/python-pillow/Pillow/pull/5377
- https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
- https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open
- https://security.gentoo.org/glsa/202107-33
Get alerted when CVE-2021-28677 or the next vulnerability affects your stack