CVE-2026-109398 — Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* f…
Published: 2026-10-12 · CVSS: 8.7 · CVSS 4.0
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7