CVE-2026-109398
Received Received - Intake

Gumlet php-image-resize Denial of Service via Memory Exhaustion

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109398
EUVD
EUVD-2026-97495

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gumlet php-image-resize 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Gumlet php-image-resize before 3.0.1 has a denial of service vulnerability. The ImageResize constructor in lib/ImageResize.php sends images to GD imagecreatefrom* functions without checking pixel limits. Attackers can upload small, highly compressed images that expand into large bitmaps, consuming all PHP memory and crashing the worker process.

Detection Guidance

Detecting this vulnerability requires monitoring for unusually high memory usage during image processing. Check PHP error logs for memory exhaustion errors and inspect uploaded images for small file sizes with large decoded dimensions. Use tools like 'top' or 'htop' to monitor PHP process memory consumption during image uploads.

Impact Analysis

This vulnerability allows remote attackers to disrupt services by causing out-of-memory errors. Systems using the affected library may experience crashes, downtime, or degraded performance when processing images.

Compliance Impact

This vulnerability primarily impacts availability by causing denial-of-service conditions through memory exhaustion. While it does not directly expose or leak data, prolonged downtime could violate service level agreements in GDPR or HIPAA environments that require high availability for processing personal or health data.

Mitigation Strategies

Immediately upgrade to Gumlet php-image-resize version 3.0.1 or later. Implement input validation to reject images with dimensions exceeding reasonable limits. Configure PHP memory limits to lower values to fail gracefully. Monitor for DoS attempts and block suspicious IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart