CVE-2019-19911: Denial of Service Vulnerability in Pillow
Summary
CVE-2019-19911: There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. Affects pillow versions < 6.2.2. Fixed in 6.2.2. How to fix ↓
Also tracked for
- py3-pillow · Alpine:v3.12
The same CVE-2019-19911 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats. The library is widely used in Python applications that deal with image processing tasks. However, versions of Pillow before 6.2.2 are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The DoS vulnerability in Pillow is caused by a flaw in the FpxImagePlugin.py module. When the number of bands in an image is large, the module calls the range function on an unvalidated 32-bit integer. On Windows running 32-bit Python, this can result in an OverflowError or MemoryError due to the 2 GB limit. On Linux running 64-bit Python, the process may be terminated by the OOM (Out of Memory) killer. An attacker can exploit this vulnerability to cause a DoS condition, potentially disrupting the availability of the affected application.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.2.2
This is the first release that contains the fix.
pip install --upgrade "pillow==6.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Pillow is not immediately feasible, a possible workaround is to limit the number of bands in the images processed by the application. By reducing the number of bands, the risk of triggering the vulnerability can be mitigated. Here is an example code snippet that demonstrates how to limit the number of bands to 4:
from PIL import Image
image = Image.open('image.jpg')
image = image.convert('RGBA')
if image.mode == 'RGBA' and image.getbands() > 4:
image = image.convert('RGB')
# Continue with image processing
Please note that this workaround may not be applicable in all scenarios and upgrading to the latest version is still the recommended solution.
Conclusion
The DoS vulnerability in Pillow before version 6.2.2 can be mitigated by upgrading to the latest version or by limiting the number of bands in the images processed by the application. It is recommended to promptly apply the necessary fixes to ensure the security and stability of the affected software. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
This vulnerability can lead to a Denial of Service condition, potentially causing the affected application to become unresponsive or crash.
Versions of Pillow before 6.2.2 are affected by this vulnerability.
The vulnerability can be triggered on Windows running 32-bit Python or Linux running 64-bit Python.
At the time of this report, there are no known public exploits specifically targeting this vulnerability.
There is no evidence of active attacks exploiting this vulnerability at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
