CVE-2021-28677: Pillow EPSImageFile Readline DoS Vulnerability
Summary
CVE-2021-28677: An issue was discovered in Pillow before 8.2.0. Affects pillow versions < 8.2.0. Fixed in 8.2.0. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.14
The same CVE-2021-28677 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for opening, editing, and saving different image file formats. The EPSImageFile module in Pillow is responsible for handling Encapsulated PostScript (EPS) data. EPS files are commonly used for vector graphics and can contain complex image data. However, a vulnerability has been discovered in Pillow versions prior to 8.2.0 that affects the EPSImageFile module.
Vulnerability Detail
The vulnerability in Pillow's EPSImageFile module arises from the readline implementation used to handle line endings in EPS data. The implementation fails to efficiently handle combinations of '\r' and '\n' as line endings, resulting in a quadratic method of accumulating lines. This flaw can be exploited by a malicious EPS file to trigger a denial-of-service (DoS) attack on Pillow during the open phase, even before an image is accepted for opening. An attacker could craft a specially crafted EPS file that causes Pillow to consume excessive resources, leading to a system crash or unresponsiveness.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.2.0
This is the first release that contains the fix.
pip install --upgrade "pillow==8.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Pillow to the fixed version as soon as possible.
Conclusion
The vulnerability in Pillow's EPSImageFile module can be exploited by a malicious EPS file to perform a denial-of-service attack on Pillow. It is crucial to update Pillow to version 8.2.0 or later to mitigate this vulnerability. Failure to do so may result in resource exhaustion, system crashes, or unresponsiveness. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functionalities for working with different image file formats.
EPS stands for Encapsulated PostScript, which is a file format commonly used for vector graphics. EPS files can contain complex image data.
This vulnerability allows a malicious EPS file to trigger a denial-of-service (DoS) attack on Pillow. It can lead to excessive resource consumption, system crashes, or unresponsiveness.
To fix this vulnerability, you should upgrade Pillow to version 8.2.0 or later. Use the command 'pip install --upgrade pillow' to update Pillow.
No, there is no known workaround for this vulnerability. Updating Pillow to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
