CVE-2014-3589: Pillow - Denial of Service via Crafted Block Size
Summary
CVE-2014-3589: PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size. Affects pillow across 3 version ranges.
< 2.3.2
>= 2.5, < 2.5.2
< 205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d
Fixed in 2.3.2 or 2.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2014-3589 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pillow is a Python Imaging Library (PIL) fork that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various Python applications for image processing and manipulation. However, versions before 2.3.2 and 2.5.x before 2.5.2 of Pillow are vulnerable to a denial of service attack when processing images with a crafted block size.
Vulnerability Detail
The vulnerability (CVE-2014-3589) in the PIL/IcnsImagePlugin.py module of Pillow allows remote attackers to cause a denial of service by providing a specially crafted block size. This can lead to resource exhaustion and potentially disrupt the availability of the affected application. The issue arises due to insufficient validation of the block size parameter, allowing an attacker to trigger the vulnerability by providing a malicious image file.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.3.22.3.2pip install --upgrade "pillow==2.3.2" -
>= 2.5, < 2.5.22.5.2pip install --upgrade "pillow==2.5.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a fixed version of Pillow to mitigate the risk.
Conclusion
The vulnerability in Pillow (CVE-2014-3589) allows remote attackers to cause a denial of service by providing a crafted block size. It is crucial to update to a fixed version of Pillow (2.3.2 or 2.5.2) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
This vulnerability allows remote attackers to cause a denial of service by providing a specially crafted block size. It can lead to resource exhaustion and potentially disrupt the availability of the affected application.
Versions before 2.3.2 and 2.5.x before 2.5.2 of Pillow are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There is no known workaround for this vulnerability. It is crucial to update to a fixed version of Pillow.
You can find more information about this vulnerability in the official advisory database of Pillow. The source is available on GitHub: https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2014-10.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
