An issue was discovered in Pillow before 10.0.0.
Priority LOW 36CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.
Why it matters now
EPSS 0.0136 71st percentileScored 2026-11-07
Fix Fixed pillow (PyPI): 10.0.0Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | pillow (PyPI) | before 10.0.0 | 10.0.0 | Patch available | GHSA-8ghj-p4vj-mr35 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- pillow (PyPI) Vendor— Affected before 10.0.0 Fixed in 10.0.0 Patch available GHSA-8ghj-p4vj-mr35
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* | before 10.0.0 | Vulnerable | python-pillow |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* Versions before 10.0.0 Vulnerable ·python-pillow
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-8ghj-p4vj-mr35 pillow (PyPI) Fixed in 10.0.0 Advisory →
Red Hat 3 advisories
- RHSA-2024:3005 Released 2024-05-22 · Red Hat rating Moderatepython-pillow security update
- Red Hat Enterprise Linux AppStream (v. 8) python-pillow-5.1.1-20.el8, python3-pillow-5.1.1-20.el8
- Red Hat Enterprise Linux CRB (v. 8) python3-pillow-5.1.1-20.el8, python3-pillow-devel-5.1.1-20.el8, python3-pillow-doc-5.1.1-20.el8 +1
- RHSA-2024:1057 Released 2024-02-29 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-installer-2.4-6.el8ap, ansible-rulebook-1.0.5-1.el8ap, automation-eda-controller-1.0.5-1.el8ap +14
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-automation-platform-installer-2.4-6.el9ap, ansible-rulebook-1.0.5-1.el9ap, automation-eda-controller-1.0.5-1.el9ap +14
- RHSA-2024:0345 Released 2024-01-23 · Red Hat rating Moderatepython-pillow security update
- Red Hat Enterprise Linux Client (v. 7) python-pillow-2.0.0-24.gitd1c6db8.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) python-pillow-2.0.0-24.gitd1c6db8.el7_9, python-pillow-devel-2.0.0-24.gitd1c6db8.el7_9, python-pillow-doc-2.0.0-24.gitd1c6db8.el7_9 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-pillow-2.0.0-24.gitd1c6db8.el7_9, python-pillow-devel-2.0.0-24.gitd1c6db8.el7_9, python-pillow-doc-2.0.0-24.gitd1c6db8.el7_9 +3
- Red Hat Enterprise Linux Server (v. 7) python-pillow-2.0.0-24.gitd1c6db8.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) python-pillow-2.0.0-24.gitd1c6db8.el7_9, python-pillow-2.0.0-24.gitd1c6db8.el7_9.ppc, python-pillow-devel-2.0.0-24.gitd1c6db8.el7_9 +5
- Red Hat Enterprise Linux Workstation (v. 7) python-pillow-2.0.0-24.gitd1c6db8.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) python-pillow-2.0.0-24.gitd1c6db8.el7_9, python-pillow-devel-2.0.0-24.gitd1c6db8.el7_9, python-pillow-doc-2.0.0-24.gitd1c6db8.el7_9 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:1057 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:1057 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3005 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:3005 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2024:0345 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2024:0345 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2024:0345 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:0345 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2024:0345 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:0345 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2024:0345 |
Not affected: 2 products
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2023-44271
- 2026-10-03 Alias added: GHSA-8ghj-p4vj-mr35
References
Patch 2
Advisory 3
Other 5
- [debian-lts-announce] 20240322 [SECURITY] [DLA 3768-1] pillow security update
- https://devhub.checkmarx.com/cve-details/CVE-2023-44271
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2023-227.yaml
- https://github.com/python-pillow/Pillow
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N2JOEDUJDQLCUII2LQYZYSM7RJL2I3P4
Sources
- CVE-2023-44271 · CVE Program
- CVE-2023-44271 · NVD
- FIRST EPSS
- GHSA-8ghj-p4vj-mr35 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-44271 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences