CVE-2026-109398

EUVD-2026-97495
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163
https://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50
https://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2
https://github.com/gumlet/php-image-resize/releases/tag/3.0.1
https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h
https://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression-bombs