Potential infinite loop in Pillow

HIGH 7.5CVE-2021-28676 · BIT-pillow-2021-28676 · GHSA-7r7m-5h27-29hp · Published 02/06/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 8.2.0`	`8.2.0`
pillow python	`< 8.2.0`	`8.2.0`

Description

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

NVD description

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.

References

nvd.nist.gov/vuln/detail/CVE-2021-28676 · ADVISORY
python-pillow/Pillow#5377 · WEB
python-pillow/Pillow commit bb6c11f · WEB
GitHub Advisory GHSA-7r7m-5h27-29hp · ADVISORY
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
lists.debian.org/debian-lts-announce/2021/07/msg00018.html · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL · WEB
pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html · WEB
security.gentoo.org/glsa/202107-33 · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL · Mailing List
lists.fedoraproject.org/archives/list/[email protected]/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free