Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCVImage class in ai/djl/opencv/ExtendedOpenCVImage.java loads images using OpenCV's imread() function without validating dimensions or pixel count before decompression. An attacker can upload a specially crafted compressed image file (e.g., PNG) that is small when compressed but expands to gigabytes of memory when loaded. This causes immediate memory exhaustion, OutOfMemoryError, and service crash. No authentication is required if the OCR service is publicly accessible. Multiple requests can completely deny service availability.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
turms 安全漏洞
Vulnerability Description
turms是turms-im开源的一个即时通讯引擎。 turms AI-Serving module v0.10.0-SNAPSHOT及之前版本存在安全漏洞，该漏洞源于图像解压缩炸弹，可能导致拒绝服务。
CVSS Information
N/A
Vulnerability Type
N/A