CVE-2021-23437: Regular Expression Denial of Service in pillow
Summary
CVE-2021-23437: The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. Affects pillow across 2 version ranges.
< 8.3.2
< 9e08eb8f78fdfd2f476e1b20b7cf38683754866b
Fixed in 9e08eb8f78fdfd2f476e1b20b7cf38683754866b. How to fix ↓
Also tracked for
The same CVE-2021-23437 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a Python package that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, versions 0 to 8.3.2 of Pillow are vulnerable to a Regular Expression Denial of Service (ReDoS) attack through the getrgb function.
Vulnerability Detail
The vulnerability in Pillow arises from a Regular Expression Denial of Service (ReDoS) issue present in the getrgb function. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition by providing a specially crafted input that triggers excessive backtracking in the regular expression pattern matching algorithm. This can lead to the application becoming unresponsive or crashing. It is important to note that this vulnerability does not directly result in remote code execution or unauthorized access to sensitive information.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9e08eb8f78fdfd2f476e1b20b7cf38683754866b
This is the first release that contains the fix.
pip install --upgrade "pillow==9e08eb8f78fdfd2f476e1b20b7cf38683754866b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Pillow versions 0 to 8.3.2 can lead to a denial of service (DoS) condition. It is crucial to upgrade to version 8.3.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
The vulnerability can lead to a denial of service (DoS) condition, causing the application to become unresponsive or crash. However, it does not directly allow for remote code execution or unauthorized access to sensitive information.
Yes, all versions of Pillow from 0 to 8.3.2 are vulnerable to this Regular Expression Denial of Service (ReDoS) issue.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the Pillow package.
No, this vulnerability does not allow for remote exploitation. An attacker would need to provide a specially crafted input to trigger the excessive backtracking in the regular expression pattern matching algorithm.
There is no known evidence of active exploitation of this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
