CVE-2021-27923: Pillow Denial of Service Vulnerability
Summary
CVE-2021-27923: Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation... Affects pillow versions < 8.1.1. Fixed in 8.1.1. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.14
The same CVE-2021-27923 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a popular Python library for image processing and manipulation. It provides a wide range of functionality for working with various image formats. This vulnerability affects versions of Pillow before 8.1.1. Pillow is vulnerable to a denial of service (DoS) attack due to improper size checking of contained images within an ICO container. This can lead to excessive memory consumption when attempting to allocate memory for a large image.
Vulnerability Detail
The vulnerability (CVE-2021-27923) in Pillow arises from a lack of proper size validation for images within an ICO container. Attackers can exploit this flaw to cause a DoS condition by providing a specially crafted ICO file with a reported size that triggers a large memory allocation. As a result, the system's memory resources can be exhausted, leading to performance degradation or even a complete system crash. This vulnerability can be particularly impactful in scenarios where Pillow is used to process untrusted image files from external sources.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.1.1
This is the first release that contains the fix.
pip install --upgrade "pillow==8.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Pillow versions prior to 8.1.1 are vulnerable to a denial of service attack due to improper size checking of images within ICO containers. This can lead to excessive memory consumption and potential system instability. It is crucial to update Pillow to version 8.1.1 or later to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
This vulnerability allows attackers to consume excessive memory resources, potentially leading to a denial of service condition. It can result in performance degradation or even a complete system crash.
At the moment, there is no known workaround for this vulnerability. It is recommended to update to the latest version of Pillow to mitigate the risk.
No, only versions of Pillow before 8.1.1 are affected. Users should upgrade to version 8.1.1 or later to address the vulnerability.
Yes, this vulnerability can be exploited remotely by providing a specially crafted ICO file to the affected system.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is important to apply the recommended security patches as a proactive measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
