CVE-2021-28678: Pillow BLPImagePlugin DoS Vulnerability
Summary
CVE-2021-28678: An issue was discovered in Pillow before 8.2.0. Affects pillow versions < 8.2.0. Fixed in 8.2.0. How to fix ↓
Also tracked for
- pillow · Bitnami
- py3-pillow · Alpine:v3.14
The same CVE-2021-28678 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving many different image file formats. The BLPImagePlugin module in Pillow is responsible for handling BLP data, which is a format commonly used in Blizzard games. This vulnerability affects versions of Pillow prior to 8.2.0.
Vulnerability Detail
The vulnerability (CVE-2021-28678) in Pillow's BLPImagePlugin arises from a lack of proper data validation. Specifically, the plugin fails to check that reads, after jumping to file offsets, return valid data. As a result, an attacker can exploit this flaw to trigger a Denial of Service (DoS) condition by repeatedly running the decoder on empty data. This can lead to resource exhaustion and potentially impact the availability of the affected system.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.2.0
This is the first release that contains the fix.
pip install --upgrade "pillow==8.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid the vulnerability by refraining from processing BLP data using the affected versions of Pillow. If BLP data is essential, it is recommended to upgrade to version 8.2.0 or apply the necessary patches to address the vulnerability.
Conclusion
In conclusion, the vulnerability (CVE-2021-28678) in Pillow's BLPImagePlugin module can be exploited to trigger a DoS condition by repeatedly running the decoder on empty data. Users are advised to upgrade to Pillow version 8.2.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functionalities for opening, manipulating, and saving different image file formats.
BLP data is a file format commonly used in Blizzard games for storing textures and images.
This vulnerability can lead to a Denial of Service (DoS) condition, potentially impacting the availability of the affected system.
To fix this vulnerability, it is recommended to upgrade Pillow to version 8.2.0 or later.
As a workaround, users can avoid the vulnerability by refraining from processing BLP data using the affected versions of Pillow.
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
