GHSA-q5hq-fp76-qmrc · Severity: high · Ecosystem: pip — Uncontrolled Resource Consumption in Pillow
An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Conclusion & alert: CVE-2021-28677 is rated Moderate Risk (58.3/100): CVSS High severity, with medium exploitation likelihood (EPSS 2.29%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-23 | 2.36% | 2.29% | -0.06% |
| 2 | 2026-06-15 | 0.26% | 2.36% | +2.09% |
| 3 | 2025-11-21 | — | 0.26% | — |
Full EPSS history (19 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-q5hq-fp76-qmrc · Severity: high · Ecosystem: pip — Uncontrolled Resource Consumption in Pillow
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
high | CVE-2021-28677: 1 source package rows (py3-pillow); 8 state rows across 8 repos (3.17-community, 3.18-community, 3.19-community, 3.20-community, 3.21-community, 3.22-community, edge-community, edge-main); fixed 8, open 0. | https://security.alpinelinux.org/vuln/CVE-2021-28677 |
debian
|
not yet assigned | CVE-2021-28677 not yet assigned priority: Debian including 1 source packages (pillow), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2021-28677 |
gentoo
|
normal | CVE-2021-28677: 1 GLSA(s) (202107-33), 1 atom(s) (dev-python/pillow); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2021-28677 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-28677 |
suse
|
high | CVE-2021-28677 severity important: SUSE including 9 source package names (python-Pillow, python-Pillow-2.8.1-4.22.1, …), 33 product×package rows across 17 product lines (HPE Helion OpenStack 8, SUSE Liberty Linux 8, … (17 product lines)): Known Not Affected 21, Fixed 12. | https://www.suse.com/security/cve/CVE-2021-28677/ |
ubuntu
|
low | CVE-2021-28677 low priority: Ubuntu including 3 source packages (pillow, pillow-python2, python-imaging), 48 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 28, released 16, ignored 2, needs-triage 2. | https://ubuntu.com/security/CVE-2021-28677 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| python | pillow | < 8.2.0 | cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* |
| fedoraproject | fedora | 33 | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://github.com/python-pillow/Pillow/pull/5377 | Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html | Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/ | |
| https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open | Third Party Advisory |
| https://security.gentoo.org/glsa/202107-33 | Third Party Advisory |