Denial of Service Vulnerability in Pillow Image Processing Library

CVE-2021-27921

Summary

The Pillow library prior to version 8.1.1 is susceptible to a Denial of Service (DoS) attack. A flaw exists in how the library handles BLP container images, which can lead to excessive memory allocation due to an inadequate check on the reported size of the images. As a result, attackers may exploit this oversight to cause significant memory consumption, potentially leading to application crashes or degraded performance.

References