Pillow Denial of Service vulnerability

HIGH 7.5CVE-2023-44271 · BIT-pillow-2023-44271 · GHSA-8ghj-p4vj-mr35 · Published 03/11/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 10.0.0`	`10.0.0`
pillow python	`< 10.0.0`	`10.0.0`

Description

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-44271 · ADVISORY
python-pillow/Pillow#7244 · WEB
python-pillow/Pillow commit 1fe1bb4 · WEB
devhub.checkmarx.com/cve-details/CVE-2023-44271 · WEB
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
lists.debian.org/debian-lts-announce/2024/03/msg00021.html · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4 · WEB
devhub.checkmarx.com/cve-details/CVE-2023-44271 · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4 · Mailing List
GitHub Advisory GHSA-8ghj-p4vj-mr35 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free