Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109398— Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Quick assessment

Affected
gumlet php-image-resize
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Gumlet php-image-resize 3.0.1 版本之前，存在一个拒绝服务漏洞。该漏洞的原因在于 中的 构造函数在将图像传递给 GD 的 系列函数时，未设置像素数量限制。远程攻击者可以上传经过高度压缩但体积很小的图像，这些图像在被解码后会生成巨大的位图，从而耗尽 PHP 内存，导致工作进程终止。

CVSS 7.5 · High EPSS 0.45% · P38

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
gumlet php-image-resize < 3.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109398

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
Source: CVE Program / CVE List V5
Vulnerability Description
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
gumlet php-image-resize 0 ~ 3.0.1 -

II. Public POCs for CVE-2026-109398

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109398

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-109398 (4)

Vendor Advisories for CVE-2026-109398 (2)

IV. Related Vulnerabilities

Same weakness: CWE-409

V. Comments for CVE-2026-109398

No comments yet

Leave a comment