An issue was discovered in Pillow before 6.2.0.
Priority LOW 38CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 9 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Why it matters now
EPSS 0.03128 87th percentileScored 2026-11-07
Fix Partial pillow (PyPI): 6.2.0Red Hat: 3 advisoriesRed Hat: 9 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | pillow (PyPI) | before 6.2.0 | 6.2.0 | Patch available | GHSA-j7mj-748x-7p78 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- pillow (PyPI) Vendor— Affected before 6.2.0 Fixed in 6.2.0 Patch available GHSA-j7mj-748x-7p78
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | before 6.2.0 | Vulnerable | python-pillow |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
- cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* Versions before 6.2.0 Vulnerable ·python-pillow
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-j7mj-748x-7p78 pillow (PyPI) Fixed in 6.2.0 Advisory →
Red Hat 3 advisories
- RHSA-2020:0578 Released 2020-02-24 · Red Hat rating Importantpython-pillow security update
- Red Hat Enterprise Linux Client (v. 7) python-pillow-2.0.0-20.gitd1c6db8.el7_7
- Red Hat Enterprise Linux Client Optional (v. 7) python-pillow-2.0.0-20.gitd1c6db8.el7_7, python-pillow-devel-2.0.0-20.gitd1c6db8.el7_7, python-pillow-doc-2.0.0-20.gitd1c6db8.el7_7 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-pillow-2.0.0-20.gitd1c6db8.el7_7, python-pillow-devel-2.0.0-20.gitd1c6db8.el7_7, python-pillow-doc-2.0.0-20.gitd1c6db8.el7_7 +3
- Red Hat Enterprise Linux Server (v. 7) python-pillow-2.0.0-20.gitd1c6db8.el7_7
- Red Hat Enterprise Linux Server Optional (v. 7) python-pillow-2.0.0-20.gitd1c6db8.el7_7, python-pillow-2.0.0-20.gitd1c6db8.el7_7.ppc, python-pillow-devel-2.0.0-20.gitd1c6db8.el7_7 +5
- Red Hat Enterprise Linux Workstation (v. 7) python-pillow-2.0.0-20.gitd1c6db8.el7_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) python-pillow-2.0.0-20.gitd1c6db8.el7_7, python-pillow-devel-2.0.0-20.gitd1c6db8.el7_7, python-pillow-doc-2.0.0-20.gitd1c6db8.el7_7 +3
- RHSA-2020:0580 Released 2020-02-24 · Red Hat rating Importantpython-pillow security update
- Red Hat Enterprise Linux AppStream (v. 8) python-pillow-5.1.1-10.el8_1, python3-pillow-5.1.1-10.el8_1
- RHSA-2020:0566 Released 2020-02-20 · Red Hat rating Importantpython-pillow security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) python-pillow-5.1.1-10.el8_0, python3-pillow-5.1.1-10.el8_0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:0580 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.0) | Fixed | RHSA-2020:0566 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:0578 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:0578 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:0578 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:0578 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:0578 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:0578 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:0578 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-16865
- 2026-10-03 Alias added: GHSA-j7mj-748x-7p78
References
Advisory 13
- https://pillow.readthedocs.io/en/latest/releasenotes/6.2.0.html
- FEDORA-2019-e7c83bdf19
- FEDORA-2019-19a161d540
- USN-4272-1
- RHSA-2020:0566
- DSA-4631
- RHSA-2020:0580
- RHSA-2020:0578
- RHSA-2020:0681
- RHSA-2020:0683
- RHSA-2020:0694
- https://nvd.nist.gov/vuln/detail/CVE-2019-16865
- https://github.com/advisories/GHSA-j7mj-748x-7p78
Other 8
- https://github.com/python-pillow/Pillow/issues/4123
- https://github.com/python-pillow/Pillow/commit/ab52630d0644e42a75eb88b78b9a9d7438a6fbeb
- https://usn.ubuntu.com/4272-1
- https://ubuntu.com/security/notices/USN-4272-1
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LYDXD7EE4YAEVSTNIFZKNVPRVJX5ZOG3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EMJBUZQGQ2Q7HXYCQVRLU7OXNC7CAWWU
- https://github.com/python-pillow/Pillow
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2019-110.yaml
Sources
- CVE-2019-16865 · CVE Program
- CVE-2019-16865 · NVD
- FIRST EPSS
- GHSA-j7mj-748x-7p78 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-16865 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences