CVE-2021-23437: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days.

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only
• Python Pillow: from 5.2.0, before 8.3.2 (fixed in 8.3.2)

Published 2021-09-03. Last modified 2026-06-17.