CVE-2021-27923
python-pillow: Excessive memory allocation in ICO image reader
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 3, 2021
Updated · June 28, 2026
Description
A flaw was found in python-pillow. Attackers can cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1284 · Improper Validation of Specified Quantity in Input