Denial of Service Vulnerability in Pillow PDF Parser by Pillow

CVE-2021-25292

Summary

A vulnerability has been identified in Pillow's PDF parser prior to version 8.1.1, which is susceptible to a ReDoS attack. An attacker can exploit this vulnerability by crafting a malicious PDF file that, when processed, triggers catastrophic backtracking in the regular expression engine. This can lead to a significant slowdown or complete denial of service for applications relying on Pillow for PDF parsing, complicating user access and system functionality. Users are advised to update to the latest version to mitigate this risk.

References