CVE-2021-28677

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.

• https://github.com/python-pillow/Pillow/pull/5377Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-openThird Party Advisory
• https://security.gentoo.org/glsa/202107-33Third Party Advisory
• https://github.com/python-pillow/Pillow/pull/5377Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/07/msg00018.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/
• https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-openThird Party Advisory
• https://security.gentoo.org/glsa/202107-33Third Party Advisory

Published

Jun 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28671Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), Wor…9.8
• CVE-2021-28672Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), Wor…9.8
• CVE-2021-28673Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), Wor…9.8
• CVE-2021-28674The node management page in SolarWinds Orion Platform before…5.4
• CVE-2021-28675An issue was discovered in Pillow before 8.2.0. PSDImagePlug…5.5
• CVE-2021-28676An issue was discovered in Pillow before 8.2.0. For FLI data…7.5
• CVE-2021-28678An issue was discovered in Pillow before 8.2.0. For BLP data…5.5
• CVE-2021-28680The devise_masquerade gem before 1.3 allows certain attacks …8.1
• CVE-2021-28681Pion WebRTC before 3.0.15 didn't properly tear down the DTLS…5.3
• CVE-2021-28682An issue was discovered in Envoy through 1.71.1. There is a …7.5
• CVE-2021-28683An issue was discovered in Envoy through 1.71.1. There is a …7.5
• CVE-2021-28684The XML parser used in ConeXware PowerArchiver before 20.10.…4.3