Skip to content

Pillow Denial of Service by Uncontrolled Resource Consumption

High severity GitHub Reviewed Published Mar 18, 2021 to the GitHub Advisory Database • Updated Apr 3, 2024

Package

pip Pillow (pip)

Affected versions

< 8.1.1

Patched versions

8.1.1

Description

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.

References

Published by the National Vulnerability Database Mar 3, 2021
Reviewed Mar 12, 2021
Published to the GitHub Advisory Database Mar 18, 2021
Last updated Apr 3, 2024

Severity

High
7.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CVE ID

CVE-2021-27921

GHSA ID

GHSA-f4w8-cv6p-x6r5

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.