CVE-2021-28677
mediumpriority · track · 31EPSS 0.025 · 84 %ileDEEURUUSEPSS · scored 2026-10-27
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (20)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-1835Red Hat Enterprise Linux (python-pillow): Mehrere SchwachstellenDeutsch2021-11-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in python-pillow ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.
- GHSA-q5hq-fp76-qmrcUncontrolled Resource Consumption in Pillow2021-06-08ghsa · osvUS
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
- BIT-pillow-2021-286772024-03-06vendor · osvUS
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
- PYSEC-2021-932021-06-02vendor · osvUS
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
also known as (8)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (25)
External citations — patches, advisories, analysis.
- https://github.com/python-pillow/Pillow/pull/5377cnnvd
- https://github.com/python-pillow/Pillow/releases/tag/8.2.0Patchcnnvd
- https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/cnnvd
- https://packetstormsecurity.com/files/162718/Ubuntu-Security-Notice-USN-4963-1.htmlcnnvd
- https://packetstormsecurity.com/files/163500/Gentoo-Linux-Security-Advisory-202107-33.htmlcnnvd
- https://packetstormsecurity.com/files/164871/Red-Hat-Security-Advisory-2021-4149-03.htmlcnnvd
- https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-opencnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan