Skip to main content

Pillow CVE-2022-45199

HIGH
Uncontrolled Resource Consumption (CWE-400)
2022-11-14 cve@mitre.org
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 14, 2022 - 07:15 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 202 pypi packages depend on pillow (157 direct, 46 indirect)

Ecosystem-wide dependent count for version 9.2.0.

DescriptionNVD

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

AnalysisAI

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. Affected products include: Python Pillow. Version information: before 9.3.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.

More in Pillow

View all
CVE-2022-30595 CRITICAL POC
9.8 May 25

libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. Rated

CVE-2026-59204 HIGH POC
8.7 Jul 14

Denial of service in Python Pillow (versions 8.2.0 through 12.2.0) allows remote attackers to exhaust memory during JPEG

CVE-2026-54058 HIGH POC
8.3 Jul 14

Out-of-bounds memory disclosure in Python Pillow before 12.3.0 lets an attacker who supplies a crafted McIdas AREA image

CVE-2026-59197 HIGH POC
8.2 Jul 14

Heap out-of-bounds write in Python Pillow prior to 12.3.0 lets an attacker who controls the rank-filter size parameter c

CVE-2026-59200 HIGH POC
7.5 Jul 14

Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause d

CVE-2021-23437 HIGH POC
7.5 Sep 03

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb

CVE-2025-48379 HIGH POC
7.1 Jul 01

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a

CVE-2016-4009 CRITICAL
9.8 Apr 13

Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote

CVE-2014-3007 CRITICAL
10.0 Apr 27

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands v

CVE-2021-34552 CRITICAL
9.8 Jul 13

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters

CVE-2021-25289 CRITICAL
9.8 Mar 19

An issue was discovered in Pillow before 8.1.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely explo

CVE-2020-5312 CRITICAL
9.8 Jan 03

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. Rated critical severity (CVSS 9.8), this

Share

CVE-2022-45199 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy