Live › vulnerability › GHSA-jgpv-4h4c-xhw3
Go to dashboardPillow before 8.1.1 does not check the declared size of an image inside a BLP container, so an attempted memory allocation can be very large. An attacker who supplies a crafted image can exhaust memory and crash the process that reads it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:04 UTC. All times on this page are UTC.
Any application that uses Pillow before to open image files it does not fully trust, such as user uploads or images fetched from external URLs, is exposed. Services that only process images they generated or that come from a trusted source are less exposed. Teams not reading untrusted BLP files can skip it.
8.1.1| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pillow | pypi | < 8.1.1 | 8.1.2 |
pip show pillow and confirm the version is below 8.1.1PIL.Image.open or Image.open calls that read untrusted uploads8.1.2 or later, the fixed version named in the sourceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-f4w8-cv6p-x6r5. This link is maintained to preserve external references.
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
https://nvd.nist.gov/vuln/detail/CVE-2021-27921
If you have any questions or comments about this advisory:
This page as .md · .json · in your agent: get_signal("GHSA-jgpv-4h4c-xhw3")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.