CVE-2021-27921: Pillow Denial of Service Vulnerability
Summary
CVE-2021-27921: Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation c... Affects pillow versions < 8.1.1. Fixed in 8.1.1. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.14
The same CVE-2021-27921 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats. The library is widely used in applications that require image processing capabilities. However, Pillow versions prior to 8.1.1 are vulnerable to a denial of service (DoS) attack due to improper size checking of contained images in BLP containers. This vulnerability can be exploited by attackers to cause excessive memory consumption, potentially leading to system instability or crashes.
Vulnerability Detail
The vulnerability (CVE-2021-27921) in Pillow arises from the lack of proper size validation for images within BLP containers. When processing a BLP container, Pillow fails to adequately check the reported size of the contained image. As a result, an attacker can craft a malicious BLP container with an excessively large reported size, triggering a memory allocation that can consume a significant amount of memory. This can lead to a denial of service condition, causing the system to become unresponsive or crash. The impact of this vulnerability depends on the context in which Pillow is used, but it has the potential to disrupt the availability of affected systems.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.1.1
This is the first release that contains the fix.
pip install --upgrade "pillow==8.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update Pillow to the latest version as soon as possible.
Conclusion
The vulnerability in Pillow (CVE-2021-27921) allows attackers to cause a denial of service condition by exploiting the improper size checking of contained images in BLP containers. To mitigate this vulnerability, it is crucial to update Pillow to version 8.1.1 or later. Failure to address this issue may result in system instability or crashes. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
This vulnerability allows attackers to cause a denial of service (DoS) condition by consuming excessive memory, potentially leading to system instability or crashes.
Versions of Pillow prior to 8.1.1 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to update Pillow to the latest version.
You can update Pillow to the latest version by running the command 'pip install --upgrade pillow'.
There is no known public exploit for this vulnerability at the time of writing.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
