{"id":"CVE-2021-23437","aliases":["ALPINE-CVE-2021-23437","BIT-pillow-2021-23437","DEBIAN-CVE-2021-23437","DLA-3768-1","DLA-4462-1","EUVD-2021-0170","GHSA-98vv-pw6r-q6q4","MGASA-2021-0448","OESA-2021-1383","PYSEC-2021-317","ROOT-APP-PYPI-CVE-2021-23437","SNYK-PYTHON-PILLOW-1319443","SUSE-SU-2021:3234-1","SUSE-SU-2021:3235-1","SUSE-SU-2024:1673-1","SUSE-SU-2024:1673-2","UBUNTU-CVE-2021-23437","USN-5227-1","USN-5227-2","openSUSE-SU-2024:11209-1","openSUSE-SU-2024:13827-1","openSUSE-SU-2026:11261-1"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0324,"percentile":0.88469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-400"],"published":"2021-09-03T16:10:10Z","modified":"2026-11-05T06:15:10Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["8.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.11","package":"py-pillow","fixed_in":["6.2.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-pillow","fixed_in":["7.1.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-pillow","fixed_in":["7.2.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-pillow","fixed_in":["8.2.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-pillow","fixed_in":["8.4.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"pillow","fixed_in":["8.3.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pillow","fixed_in":["8.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["8.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["8.3.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-pillow","fixed_in":["8.1.2-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-pillow","fixed_in":["8.1.1-7.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"python-pillow","fixed_in":["8.1.1-7.oe1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"pillow","fixed_in":["8.0.1+aikido.1","8.1.2+aikido.1","8.0.1+aikido.2","8.2.0+aikido.1","7.0.0+aikido.2","7.0.0+aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Pillow","fixed_in":["4.2.1-3.20.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Pillow","fixed_in":["4.2.1-3.20.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Pillow","fixed_in":["4.2.1-3.20.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","fixed_in":["5.2.0-3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","fixed_in":["5.2.0-3.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","fixed_in":["2.3.0-1ubuntu3.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pillow","fixed_in":["3.1.2-0ubuntu1.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"pillow","fixed_in":["5.1.0-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"pillow","fixed_in":["7.0.0-4ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pillow","fixed_in":["9.0.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"8.3.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"pillow","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.0"},{"fixed":"8.3.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-2+deb10u5"}]}],"versions":["5.4.1-2","5.4.1-2+deb10u1","5.4.1-2+deb10u2","5.4.1-2+deb10u3","5.4.1-2+deb10u4"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2+dfsg-0.3+deb11u3"}]}],"versions":["8.1.2+dfsg-0.3","8.1.2+dfsg-0.3+deb11u1","8.1.2+dfsg-0.3+deb11u2"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"8.3.2"}]}],"versions":["5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-7.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-7.oe1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"9e08eb8f78fdfd2f476e1b20b7cf38683754866b"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1+aikido.1"},{"fixed":"8.1.2+aikido.1"},{"fixed":"8.0.1+aikido.2"},{"fixed":"8.2.0+aikido.1"},{"fixed":"7.0.0+aikido.2"},{"fixed":"7.0.0+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-3.20.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-3.20.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-3.20.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-150300.3.15.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.0-150300.3.15.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4+esm3"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3","2.3.0-1ubuntu3.4","2.3.0-1ubuntu3.4+esm1","2.3.0-1ubuntu3.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.6+esm1"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1","3.1.2-0ubuntu1.1","3.1.2-0ubuntu1.3","3.1.2-0ubuntu1.4","3.1.2-0ubuntu1.5","3.1.2-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.7"}]}],"versions":["4.1.1-3build2","4.3.0-2ubuntu1","5.0.0-1","5.1.0-1","5.1.0-1ubuntu0.2","5.1.0-1ubuntu0.3","5.1.0-1ubuntu0.4","5.1.0-1ubuntu0.5","5.1.0-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-4ubuntu0.5"}]}],"versions":["6.1.0-1","6.1.0-1build1","6.2.1-2","7.0.0-4","7.0.0-4build1","7.0.0-4ubuntu0.1","7.0.0-4ubuntu0.2","7.0.0-4ubuntu0.3","7.0.0-4ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pillow-python2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1-3~build1","6.2.1-3","6.2.1-3ubuntu0.1~esm1","6.2.1-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1"}]}],"versions":["8.1.2+dfsg-0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.7"}]}],"versions":["4.1.1-3build2","4.3.0-2ubuntu1","5.0.0-1","5.1.0-1","5.1.0-1ubuntu0.2","5.1.0-1ubuntu0.3","5.1.0-1ubuntu0.4","5.1.0-1ubuntu0.5","5.1.0-1ubuntu0.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-4ubuntu0.5"}]}],"versions":["6.1.0-1","6.1.0-1build1","6.2.1-2","7.0.0-4","7.0.0-4build1","7.0.0-4ubuntu0.1","7.0.0-4ubuntu0.2","7.0.0-4ubuntu0.3","7.0.0-4ubuntu0.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1ubuntu3.4+esm3"}]}],"versions":["2.2.1-1ubuntu2","2.2.1-2ubuntu1","2.2.1-3ubuntu2","2.2.1-3ubuntu3","2.2.1-3ubuntu4","2.2.1-3ubuntu6","2.3.0-1ubuntu1","2.3.0-1ubuntu2","2.3.0-1ubuntu3","2.3.0-1ubuntu3.2","2.3.0-1ubuntu3.3","2.3.0-1ubuntu3.4","2.3.0-1ubuntu3.4+esm1","2.3.0-1ubuntu3.4+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-0ubuntu1.6+esm1"}]}],"versions":["2.9.0-1","3.0.0-1","3.0.0-1build1","3.1.0-1","3.1.1-1","3.1.2-0ubuntu1","3.1.2-0ubuntu1.1","3.1.2-0ubuntu1.3","3.1.2-0ubuntu1.4","3.1.2-0ubuntu1.5","3.1.2-0ubuntu1.6"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-1.2"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3.0-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.0-1.1"}]}],"bundled":24}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"python","product":"pillow"},{"vendor":"python-pillow","product":"pillow"}],"references":[{"url":"https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443","tags":["x_transferred","Exploit","Patch","Release Notes","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202211-10","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23437","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT","tags":["web"]},{"url":"https://github.com/advisories/GHSA-98vv-pw6r-q6q4","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-23437","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23437","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0448.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29481","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1383","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213234-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190229","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23437","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213235-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241673-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180833","tags":["report"]},{"url":"https://bugzilla.suse.com/1183101","tags":["report"]},{"url":"https://bugzilla.suse.com/1183102","tags":["report"]},{"url":"https://bugzilla.suse.com/1183103","tags":["report"]},{"url":"https://bugzilla.suse.com/1183105","tags":["report"]},{"url":"https://bugzilla.suse.com/1183107","tags":["report"]},{"url":"https://bugzilla.suse.com/1183108","tags":["report"]},{"url":"https://bugzilla.suse.com/1183110","tags":["report"]},{"url":"https://bugzilla.suse.com/1188574","tags":["report"]},{"url":"https://bugzilla.suse.com/1194551","tags":["report"]},{"url":"https://bugzilla.suse.com/1194552","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22816","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241673-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23437","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5227-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5227-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-34552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22817","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55379","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-23437","title":"Regular Expression Denial of Service (ReDoS)","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:10:10.293Z","modified":"2024-09-16T20:47:41.102Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-0170","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:10:10Z","modified":"2024-09-16T20:47:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:10.854479Z"}],"ghsa":[{"id":"GHSA-98vv-pw6r-q6q4","title":"Uncontrolled Resource Consumption in pillow","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-07T23:08:10Z","modified":"2024-10-09T21:02:06Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125","CWE-400"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2021-23437","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:15:08.317Z","modified":"2026-06-17T03:38:45.71Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:58.05696Z"}],"osv":[{"id":"ALPINE-CVE-2021-23437","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:15:08.317Z","modified":"2026-11-03T06:32:31.981876468Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2021-23437","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:15:08.317Z","modified":"2026-10-20T10:54:32.198880201Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"DEBIAN-CVE-2021-23437","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:15:08.317Z","modified":"2026-10-23T18:04:49.492077015Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-98vv-pw6r-q6q4","title":"Uncontrolled Resource Consumption in pillow","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-07T23:08:10Z","modified":"2024-10-09T21:08:55.45238Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-125","CWE-400"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"OESA-2021-1383","title":"python-pillow security update","description":"Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.\r\n\r\nSecurity Fix(es):\r\n\r\nThe package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.(CVE-2021-23437)","status":"published","published":"2021-10-15T11:04:39Z","modified":"2026-08-18T01:16:04.602049533Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-23437","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:15:00Z","modified":"2026-02-04T02:59:26.711362Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"BIT-pillow-2021-23437","title":"Regular Expression Denial of Service (ReDoS)","description":"The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2024-03-06T11:05:30.378Z","modified":"2026-09-08T08:48:18.465277584Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"DLA-3768-1","title":"pillow - security update","status":"published","published":"2024-03-22T00:00:00Z","modified":"2026-03-09T01:21:10.947612Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-4462-1","title":"pillow - security update","status":"published","published":"2026-02-01T00:00:00Z","modified":"2026-02-01T04:30:13.308807Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2021-0448","title":"Updated python-pillow packages fix security vulnerability","description":"Updated python-pillow packages fix security vulnerability:\n\nThe package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular\nExpression Denial of Service (ReDoS) via the getrgb function\n(CVE-2021-23437).\n","status":"published","published":"2021-09-29T17:22:22Z","modified":"2026-04-16T04:43:24.910766416Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11209-1","title":"python36-Pillow-8.3.2-1.2 on GA media","description":"These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:01.713817Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13827-1","title":"python310-Pillow-10.3.0-1.1 on GA media","description":"These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:45.098529Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:11261-1","title":"python313-Pillow-12.3.0-1.1 on GA media","description":"These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-12T00:00:00Z","modified":"2026-07-13T09:00:11.048299149Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2021-317","description":"The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.","status":"published","published":"2021-09-03T16:15:00Z","modified":"2023-12-06T01:00:56.992827Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"ROOT-APP-PYPI-CVE-2021-23437","title":"CVE-2021-23437 in pillow - Patched by Root","description":"Root has patched CVE-2021-23437 in the pillow package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-05T05:49:19Z","modified":"2026-11-05T06:15:10.857211632Z","updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"SUSE-SU-2021:3234-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- CVE-2021-23437: Fixed regular expression denial of service (ReDoS) via the getrgb function (bsc#1190229).\n","status":"published","published":"2021-09-27T14:36:34Z","modified":"2026-02-04T02:55:52.444661Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3235-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- CVE-2021-23437: Fixed regular expression denial of service (ReDoS) via the getrgb function (bsc#1190229).\n","status":"published","published":"2021-09-27T14:36:47Z","modified":"2026-02-04T03:51:20.699739Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2024:1673-1","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)\n- Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)\n- Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)\n- Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)\n- Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)\n- Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)\n- Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)\n- Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)\n- OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)\n","status":"published","published":"2024-05-17T07:30:17Z","modified":"2026-02-04T02:30:30.558488Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1673-2","title":"Security update for python-Pillow","description":"This update for python-Pillow fixes the following issues:\n\n- Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)\n- Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)\n- Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)\n- Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)\n- Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)\n- Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)\n- Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)\n- Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)\n- OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)\n","status":"published","published":"2024-06-13T09:22:50Z","modified":"2026-02-04T02:21:47.288276Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-5227-1","title":"pillow vulnerabilities","description":"It was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to hang, resulting in a denial\nof service. (CVE-2021-23437)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 21.04. (CVE-2021-34552)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2022-22815)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service. (CVE-2022-22816)\n\nIt was discovered that Pillow incorrectly handled certain image files. If a\nuser or automated system were tricked into opening a specially-crafted\nfile, a remote attacker could cause Pillow to crash, resulting in a denial\nof service, or possibly execute arbitrary code. (CVE-2022-22817)\n","status":"published","published":"2022-01-13T13:26:09Z","modified":"2026-04-27T16:20:57.391935Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5227-2","title":"pillow vulnerabilities","description":"USN-5227-1 fixed several vulnerabilities in Pillow. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to hang, resulting in a denial\n of service. (CVE-2021-23437)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\n Ubuntu 21.04. (CVE-2021-34552)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service, or possibly execute arbitrary code. (CVE-2022-22815)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service. (CVE-2022-22816)\n\n It was discovered that Pillow incorrectly handled certain image files. If a\n user or automated system were tricked into opening a specially-crafted\n file, a remote attacker could cause Pillow to crash, resulting in a denial\n of service, or possibly execute arbitrary code. (CVE-2022-22817)\n","status":"published","published":"2022-01-17T13:14:11Z","modified":"2026-06-29T13:49:35.559949571Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}