GHSA-fc9g-5qg7-mf45: Security vulnerability
On Pillow 12.3.0 and upstream main (ad277e2761b489681e71b51e91367d46b0ceabb9), a GIF with a long comment makes getglobalheader() copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU denial of service, with CVSS-B 6.9 assuming a network service automatically opens unauthenticated uploads and they are resaved as GIFs; impact depends on input-size, concurrency, and worker CPU limits.
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments that automatically open untrusted GIF uploads and save them again as GIFs are exposed. Risk is higher where this processing is available without authentication and where worker CPU limits or concurrency controls are weak.
What must an attacker provide to trigger the excessive CPU use?
An attacker needs to supply a crafted GIF containing a long comment that is subsequently processed and saved as a GIF by Pillow. Comments carried over from untrusted images can also trigger the repeated copying behavior.
Are applications that only read or display uploaded GIFs affected?
The described behavior occurs when saving a GIF, so the provided data supports exposure for workflows that resave GIFs. It does not establish impact for workflows that only read or display them.
What can be done if updating is not immediately possible?
Limit or reject untrusted GIF inputs with long comments before processing, and avoid resaving untrusted images as GIFs where possible. Apply worker CPU limits and restrict concurrency to reduce the effect of crafted-image processing.