Description
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Published: 2026-10-12
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is found in Gumlet's php-image-resize library before version 3.0.1. The ImageResize constructor forwards incoming images directly to GD's imagecreatefrom* functions without imposing any pixel limits. Attackers can supply a very small, highly compressed image that expands to a giant bitmap, consuming PHP's memory and causing the worker process to terminate. This results in a denial of service to all users sharing that process.

Affected Systems

All installations of Gumlet's php-image-resize library older than 3.0.1 are affected, regardless of the platform on which PHP is running.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited remotely by uploading an image through any exposed endpoint that uses the library; no authentication or elevated privileges are required. Once triggered, the process will deplete memory and crash, leading to repeated service outages until the worker is restarted.

Generated by OpenCVE AI on October 12, 2026 at 16:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to php-image-resize version 3.0.1 or later, which adds pixel limits to image creation.
  • If an immediate upgrade is not possible, implement an upper bound on the size of uploaded image files or the dimensions of decompressed bitmaps before passing them to GD.
  • Set practical PHP memory_limit values to prevent a single oversized image from exhausting the entire process.

Generated by OpenCVE AI on October 12, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Gumlet
Gumlet php-image-resize
Vendors & Products Gumlet
Gumlet php-image-resize

Mon, 12 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Title Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
Weaknesses CWE-409
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Gumlet Php-image-resize
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T18:20:30.276Z

Reserved: 2026-10-12T14:40:48.402Z

Link: CVE-2026-109398

cve-icon Vulnrichment

Updated: 2026-10-13T18:20:26.022Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T16:17:05.397

Modified: 2026-10-16T19:21:14.417

Link: CVE-2026-109398

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:26:41Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)