GHSA-jgpv-4h4c-xhw3High· 7.5▾ TwilightDuplicate Advisory: Uncontrolled Resource Consumption in pillow
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-f4w8-cv6p-x6r5. This link is maintained to preserve external references.
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
https://nvd.nist.gov/vuln/detail/CVE-2021-27921
If you have any questions or comments about this advisory:
pillow < 8.1.1Upgrade to a patched release:
pillow 8.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96637High· 6.5Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
CVE-2026-96640High· 8.2Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96636Medium· 6.5Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
CVE-2026-96638Medium· 6.5Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
CVE-2026-112400High· 7.5Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-40192High· 7.5Pillow is a Python imaging library