CVE-2026-65650
Received Received - Intake

Avatar Denial of Service in Elgg Before 7.0.0

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MITRE

Description
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-65650
EUVD
EUVD-2026-47759

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elgg elgg to 7.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Elgg before version 7.0.0 is vulnerable to a denial of service attack due to improper validation of image dimensions during avatar uploads. Attackers can upload extremely large images, causing the system to consume excessive memory while attempting to resize them, leading to out-of-memory errors and service disruption.

Detection Guidance

Check Elgg version to see if it is below 7.0.0. Monitor for large avatar uploads or image processing failures. Look for out-of-memory errors in system logs during image resizing operations.

Impact Analysis

If you use Elgg versions before 7.0.0, an attacker could upload a very large image as an avatar, causing the server to run out of memory while processing it. This could slow down or crash your Elgg instance, making it unavailable to users. Regular users might experience delays or errors when accessing the site.

Compliance Impact

The vulnerability allows large avatar uploads that could cause out-of-memory issues, potentially leading to denial-of-service conditions. This may impact compliance by disrupting availability of systems handling personal data, which could violate GDPR's requirement for secure and available processing or HIPAA's availability standards for protected health information.

Mitigation Strategies
  • Upgrade Elgg to version 7.0.0 or later to apply the fix.
  • Set image_resize_max_height, image_resize_max_width, and image_resize_max_resolution to appropriate limits in Elgg configuration.
  • Monitor and restrict large image uploads to prevent denial of service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65650. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart