Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    BREW-AIDER-CVE-2021-23437 (GHSA-98VV-PW6R-Q6Q4)

    Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-09 23:40 – Source website
    VLAI
    Summary
    Uncontrolled Resource Consumption in pillow
    Details

    The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "pillow",
        "resource_purl": "pkg:pypi/pillow@12.1.1",
        "upstream_fixed_in": "8.3.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "aider",
        "purl": "pkg:brew/aider"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.86.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/pillow@12.1.1",
        "name": "pillow",
        "resource": "pillow",
        "strategy": "registry",
        "subject_version": "12.1.1"
      }
    ]
  },
  "details": "The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.",
  "id": "BREW-aider-CVE-2021-23437",
  "modified": "2026-09-09T23:40:56Z",
  "published": "2026-08-13T16:35:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23437"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-98vv-pw6r-q6q4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2021-317.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT"
    },
    {
      "type": "WEB",
      "url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202211-10"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Uncontrolled Resource Consumption in pillow",
  "upstream": [
    "GHSA-98vv-pw6r-q6q4",
    "BIT-pillow-2021-23437",
    "CVE-2021-23437",
    "PYSEC-2021-317",
    "SNYK-PYTHON-PILLOW-1319443"
  ]
}

    BREW-PILLOW-CVE-2021-23437 (CVE-2021-23437)

    Vulnerability from osv_homebrew – Published: 2026-08-13 17:28 – Updated: 2026-09-10 20:25 – Source website
    VLAI
    Details

    The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    References
    To clipboard 

    {
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "8.3.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pillow",
        "purl": "pkg:brew/pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/python-pillow/pillow",
        "name": "https://github.com/python-pillow/pillow",
        "strategy": "git",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/pillow@12.3.0",
        "name": "pillow",
        "strategy": "registry",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "Debian",
        "key": "Debian/pillow",
        "name": "pillow",
        "strategy": "distro"
      },
      {
        "ecosystem": "GIT",
        "key": "upstream:https://github.com/python-pillow/pillow",
        "name": "https://github.com/python-pillow/pillow",
        "strategy": "distro",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "PyPI",
        "key": "upstream:pkg:pypi/pillow@12.3.0",
        "name": "pillow",
        "strategy": "distro",
        "subject_version": "12.3.0"
      },
      {
        "ecosystem": "Ubuntu",
        "key": "Ubuntu/pillow",
        "name": "pillow",
        "strategy": "distro"
      }
    ]
  },
  "details": "The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.",
  "id": "BREW-pillow-CVE-2021-23437",
  "modified": "2026-09-10T20:25:15Z",
  "published": "2026-08-13T17:28:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNSG6VFXTAROGF7ACYLMAZNQV4EJ6I2C/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT/"
    },
    {
      "type": "ADVISORY",
      "url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/202211-10"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
    },
    {
      "type": "FIX",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2021-23437",
    "BIT-pillow-2021-23437",
    "GHSA-98vv-pw6r-q6q4",
    "PYSEC-2021-317",
    "SNYK-PYTHON-PILLOW-1319443"
  ]
}

    PYSEC-2021-317

    Vulnerability from pysec - Published: 2021-09-03 16:15 - Updated: 2021-09-03 18:35
    VLAI
    Details

    The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

    Impacted products
    Name purl
    pillow pkg:pypi/pillow
    Aliases
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pillow",
        "purl": "pkg:pypi/pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
            }
          ],
          "repo": "https://github.com/python-pillow/Pillow",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0",
        "1.1",
        "1.2",
        "1.3",
        "1.4",
        "1.5",
        "1.6",
        "1.7.0",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.7.4",
        "1.7.5",
        "1.7.6",
        "1.7.7",
        "1.7.8",
        "2.0.0",
        "2.1.0",
        "2.2.0",
        "2.2.1",
        "2.2.2",
        "2.3.0",
        "2.3.1",
        "2.3.2",
        "2.4.0",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.6.0",
        "2.6.1",
        "2.6.2",
        "2.7.0",
        "2.8.0",
        "2.8.1",
        "2.8.2",
        "2.9.0",
        "3.0.0",
        "3.1.0",
        "3.1.0.rc1",
        "3.1.0rc1",
        "3.1.1",
        "3.1.2",
        "3.2.0",
        "3.3.0",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.4.0",
        "3.4.1",
        "3.4.2",
        "4.0.0",
        "4.1.0",
        "4.1.1",
        "4.2.0",
        "4.2.1",
        "4.3.0",
        "5.0.0",
        "5.1.0",
        "5.2.0",
        "5.3.0",
        "5.4.0",
        "5.4.0.dev0",
        "5.4.1",
        "6.0.0",
        "6.1.0",
        "6.2.0",
        "6.2.1",
        "6.2.2",
        "7.0.0",
        "7.1.0",
        "7.1.1",
        "7.1.2",
        "7.2.0",
        "8.0.0",
        "8.0.1",
        "8.1.0",
        "8.1.1",
        "8.1.2",
        "8.2.0",
        "8.3.0",
        "8.3.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23437",
    "SNYK-PYTHON-PILLOW-1319443",
    "GHSA-98vv-pw6r-q6q4"
  ],
  "details": "The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.",
  "id": "PYSEC-2021-317",
  "modified": "2021-09-03T18:35:52.828411Z",
  "published": "2021-09-03T16:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html"
    },
    {
      "type": "FIX",
      "url": "https://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b"
    },
    {
      "type": "ADVISORY",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-98vv-pw6r-q6q4"
    }
  ]
}