Search
Find a vulnerability
Search criteria
Related vulnerabilities
BREW-AIDER-CVE-2021-23437 (GHSA-98VV-PW6R-Q6Q4)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-09 23:40 – Source website
VLAI
Summary
Uncontrolled Resource Consumption in pillow
Details
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "pillow",
"resource_purl": "pkg:pypi/pillow@12.1.1",
"upstream_fixed_in": "8.3.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "aider",
"purl": "pkg:brew/aider"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.86.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pillow@12.1.1",
"name": "pillow",
"resource": "pillow",
"strategy": "registry",
"subject_version": "12.1.1"
}
]
},
"details": "The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.",
"id": "BREW-aider-CVE-2021-23437",
"modified": "2026-09-09T23:40:56Z",
"published": "2026-08-13T16:35:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23437"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-98vv-pw6r-q6q4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-pillow/Pillow"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202211-10"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Uncontrolled Resource Consumption in pillow",
"upstream": [
"GHSA-98vv-pw6r-q6q4",
"BIT-pillow-2021-23437",
"CVE-2021-23437",
"PYSEC-2021-317",
"SNYK-PYTHON-PILLOW-1319443"
]
}
BREW-PILLOW-CVE-2021-23437 (CVE-2021-23437)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-10-08 00:59 – Source website
VLAI
Details
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Severity
7.5 (High)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "8.3.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "pillow",
"purl": "pkg:brew/pillow"
},
"ranges": [
{
"events": [
{
"introduced": "8.2.0"
},
{
"fixed": "8.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "git",
"upstream_evidence": [
{
"ecosystem": "GIT",
"key": "https://github.com/python-pillow/pillow",
"name": "https://github.com/python-pillow/pillow",
"strategy": "git",
"subject_version": "12.3.0"
},
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pillow@12.3.0",
"name": "pillow",
"strategy": "registry",
"subject_version": "12.3.0"
},
{
"ecosystem": "Debian",
"key": "Debian/pillow",
"name": "pillow",
"strategy": "distro"
},
{
"ecosystem": "GIT",
"key": "upstream:https://github.com/python-pillow/pillow",
"name": "https://github.com/python-pillow/pillow",
"strategy": "distro",
"subject_version": "12.3.0"
},
{
"ecosystem": "PyPI",
"key": "upstream:pkg:pypi/pillow@12.3.0",
"name": "pillow",
"strategy": "distro",
"subject_version": "12.3.0"
},
{
"ecosystem": "Ubuntu",
"key": "Ubuntu/pillow",
"name": "pillow",
"strategy": "distro"
}
]
},
"details": "The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.",
"id": "BREW-pillow-CVE-2021-23437",
"modified": "2026-10-08T00:59:56Z",
"published": "2026-08-13T17:28:20Z",
"references": [
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/"
},
{
"type": "ADVISORY",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"
},
{
"type": "ADVISORY",
"url": "https://security.gentoo.org/glsa/202211-10"
},
{
"type": "FIX",
"url": "https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
},
{
"type": "FIX",
"url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"upstream": [
"CVE-2021-23437",
"BIT-pillow-2021-23437",
"GHSA-98vv-pw6r-q6q4",
"PYSEC-2021-317",
"SNYK-PYTHON-PILLOW-1319443"
]
}
PYSEC-2021-317
Vulnerability from pysec - Published: 2021-09-03 16:15 - Updated: 2021-09-03 18:35
VLAI
Details
The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Impacted products
| Name | purl | pillow | pkg:pypi/pillow |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pillow",
"purl": "pkg:pypi/pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
}
],
"repo": "https://github.com/python-pillow/Pillow",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.3.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0",
"1.1",
"1.2",
"1.3",
"1.4",
"1.5",
"1.6",
"1.7.0",
"1.7.1",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"2.0.0",
"2.1.0",
"2.2.0",
"2.2.1",
"2.2.2",
"2.3.0",
"2.3.1",
"2.3.2",
"2.4.0",
"2.5.0",
"2.5.1",
"2.5.2",
"2.5.3",
"2.6.0",
"2.6.1",
"2.6.2",
"2.7.0",
"2.8.0",
"2.8.1",
"2.8.2",
"2.9.0",
"3.0.0",
"3.1.0",
"3.1.0.rc1",
"3.1.0rc1",
"3.1.1",
"3.1.2",
"3.2.0",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.3",
"3.4.0",
"3.4.1",
"3.4.2",
"4.0.0",
"4.1.0",
"4.1.1",
"4.2.0",
"4.2.1",
"4.3.0",
"5.0.0",
"5.1.0",
"5.2.0",
"5.3.0",
"5.4.0",
"5.4.0.dev0",
"5.4.1",
"6.0.0",
"6.1.0",
"6.2.0",
"6.2.1",
"6.2.2",
"7.0.0",
"7.1.0",
"7.1.1",
"7.1.2",
"7.2.0",
"8.0.0",
"8.0.1",
"8.1.0",
"8.1.1",
"8.1.2",
"8.2.0",
"8.3.0",
"8.3.1"
]
}
],
"aliases": [
"CVE-2021-23437",
"SNYK-PYTHON-PILLOW-1319443",
"GHSA-98vv-pw6r-q6q4"
],
"details": "The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.",
"id": "PYSEC-2021-317",
"modified": "2021-09-03T18:35:52.828411Z",
"published": "2021-09-03T16:15:00Z",
"references": [
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"
},
{
"type": "FIX",
"url": "https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
},
{
"type": "ADVISORY",
"url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-98vv-pw6r-q6q4"
}
]
}