View all vulnerabilities

CVE-2021-23437

Uncontrolled Resource Consumption in pillow

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
7.5
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
pillow >= 5.2.0 < 8.3.2
Severity
High
Ecosystem
Python
Publish Date
September 7, 2021
Modified Date
October 9, 2024