CVE-2026-109398
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
409
Improper Handling of Highly Compressed Data (Data Amplification)
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Amplification
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Applicable Platforms
All platforms may be affected
https://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-…
https://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a…
https://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c…
https://github.com/gumlet/php-image-resize/releases/tag/3.0.1
https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-m…
https://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denia…