CVE-2014-9601: Pillow PNG Image Decompression Denial of Service
Summary
CVE-2014-9601: Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. Affects pillow versions < 2.7.0. Fixed in 2.7.0. How to fix ↓
Also tracked for
- pillow · Debian:11
The same CVE-2014-9601 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python imaging library that provides support for opening, manipulating, and saving many different image file formats. It is widely used in various applications for image processing and manipulation. However, versions of Pillow prior to 2.7.0 are vulnerable to a denial of service (DoS) attack when processing PNG images with large compressed text chunks. This vulnerability allows remote attackers to cause the application to crash or become unresponsive, potentially disrupting its functionality.
Vulnerability Detail
The vulnerability (CVE-2014-9601) in Pillow arises from a lack of proper validation and handling of compressed text chunks in PNG images. When a PNG image with a large compressed text chunk is processed by an application using a vulnerable version of Pillow, the decompression process can consume excessive resources, leading to a DoS condition. This can be exploited by an attacker by crafting a malicious PNG image and causing the application to crash or become unresponsive. The impact of this vulnerability can range from a temporary disruption of service to a complete denial of service, depending on the application's resilience to such attacks.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.0
This is the first release that contains the fix.
pip install --upgrade "pillow==2.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of Pillow to mitigate the risk.
Conclusion
The vulnerability (CVE-2014-9601) in Pillow allows remote attackers to cause a denial of service by exploiting the lack of proper validation and handling of compressed text chunks in PNG images. To mitigate this risk, it is crucial to upgrade to a fixed version of Pillow, specifically version 2.7.0 or later. This will ensure that the vulnerability is addressed and the application is protected against potential DoS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python imaging library that provides support for opening, manipulating, and saving various image file formats. It is widely used in applications for image processing and manipulation.
The vulnerability allows remote attackers to cause a denial of service (DoS) by exploiting the lack of proper validation and handling of compressed text chunks in PNG images. This can result in the application crashing or becoming unresponsive, potentially disrupting its functionality.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Pillow. The issue was addressed in version 2.7.0, so updating to this version or any subsequent release will resolve the problem.
No, there is no known workaround for this vulnerability. It is necessary to upgrade to a fixed version of Pillow to mitigate the risk.
You can find more information about this vulnerability in the official advisory database of the Python Packaging Authority (PyPA) at the following link: https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2015-16.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
