CVE-2023-44271

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 10.0.0

Description The issue is related to a Denial of Service in Pillow, where the truetype function in ImageFont uncontrollably allocates memory when processing a long text argument in an ImageDraw instance. This can cause a service to crash due to memory exhaustion. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Pillow versions prior to 10.0.0, update to version 10.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the length of text arguments passed to the textlength function in ImageDraw instances to prevent excessive memory allocation.