Grav is vulnerable to a resource exhaustion flaw that lets unauthenticated users bypass the image pixel limit when the URL actions feature is enabled. Attackers can request image transformations that force the GD library to allocate multi‑gigabyte canvases, consuming servers' memory and causing the web application to crash or become unresponsive. The weakness is a classic limit‑exceeded condition, classified as CWE‑400.

Affected versions are Grav releases before 1.7.53.5 and 2.2.2, specifically 1.7.53 and earlier and 2.0.0‑rc.8 through 2.2.1. The vendor is the Grav project, under the getgrav organization. No specific build numbers or patch releases beyond the stated thresholds are affected.

With a CVSS score of 8.7, this vulnerability represents a high‑severity denial of service. The EPSS score is currently unavailable, but the flaw is listed in public advisories and is not in the CISA KEV list. Attackers can exploit it remotely over HTTP using crafted image URLs; no authentication or privileged access is required. The potential impact is a complete service outage due to memory exhaustion on vulnerable servers.