CVE-2023-44271: Denial of Service Vulnerability in Pillow
Summary
CVE-2023-44271: An issue was discovered in Pillow before 10.0.0. Affects pillow across 2 version ranges.
< 1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
< 10.0.0
Fixed in 1fe1bb49c452b0318cad12ea9d97c3bef188e9a7. How to fix ↓
Also tracked for
The same CVE-2023-44271 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pillow is a popular Python library for image processing and manipulation. It provides various functionalities for working with images, including loading, saving, and editing. The library is widely used in many applications and frameworks. However, a vulnerability has been discovered in versions before 10.0.0 that can lead to a Denial of Service (DoS) attack. This vulnerability specifically affects the truetype functionality in the ImageFont module when processing long text arguments using the textlength method in an ImageDraw instance.
Vulnerability Detail
The vulnerability in Pillow allows an attacker to trigger a DoS attack by providing a long text argument to the textlength method in an ImageDraw instance. This causes the library to uncontrollably allocate memory, potentially leading to the service crashing due to running out of memory. The issue arises from a lack of proper input validation and handling of long text arguments. If exploited, this vulnerability can disrupt the availability of the affected service and impact its users.
How To Fix
Latest published version: 13.0.0 as of 22 Oct 2026
pip install --upgrade "pillow==13.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1fe1bb49c452b0318cad12ea9d97c3bef188e9a7
This is the first release that contains the fix.
pip install --upgrade "pillow==1fe1bb49c452b0318cad12ea9d97c3bef188e9a7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Pillow is not immediately feasible, a temporary workaround can be implemented by validating and limiting the length of text arguments passed to the textlength method. By enforcing a reasonable limit on the text length, the risk of triggering the DoS vulnerability can be mitigated. Here is an example of how to implement this workaround in Python:
from PIL import ImageFont, ImageDraw
MAX_TEXT_LENGTH = 1000
def draw_text(image, text):
if len(text) > MAX_TEXT_LENGTH:
raise ValueError('Text length exceeds maximum allowed')
font = ImageFont.truetype('font.ttf', 24)
draw = ImageDraw.Draw(image)
draw.text((10, 10), text, font=font)
image = Image.new('RGB', (100, 100))
text = 'Lorem ipsum dolor sit amet'
draw_text(image, text)
Conclusion
In conclusion, the vulnerability in Pillow versions before 10.0.0 can lead to a Denial of Service attack by causing the library to run out of memory when processing long text arguments. It is crucial to upgrade to the latest version of Pillow or implement the provided workaround to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pillow →
FAQ
Pillow is a Python library for image processing and manipulation. It provides various functionalities for working with images, including loading, saving, and editing.
A Denial of Service attack is a type of cyber attack where the attacker aims to disrupt the availability of a service or system by overwhelming it with a high volume of requests or consuming its resources.
The vulnerability in Pillow can be exploited to trigger a DoS attack, causing the affected service to crash by running out of memory. This can disrupt the availability of the service and impact its users.
To fix the vulnerability, it is recommended to upgrade to version 10.0.0 or later of the Pillow library. This version includes a fix for the DoS vulnerability.
Yes, if upgrading to the latest version of Pillow is not immediately feasible, a temporary workaround can be implemented by validating and limiting the length of text arguments passed to the textlength method.
References
Related vulnerabilities
Recent vulnerabilities recorded for pillow.
