Skip to main content

libtiff CVE-2026-36849

HIGH
2026-06-17
Gitlab Denial Of Service Suse
Share

Severity by source

vuln.today AI
7.5 HIGH

Network-delivered crafted file requires no privileges or user interaction in automated server-side processing; impact is availability-only with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

1
Analysis Generated
Jun 17, 2026 - 02:22 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial of service in libtiff v4.7.1 and prior allows processing of a crafted TIFF file containing an abnormally large SamplesPerPixel tag value to crash or hang the affected process. Any application or service that passes attacker-controlled TIFF files through libtiff is potentially vulnerable, including web-based image processors, document converters, and media ingestion pipelines. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of this analysis.

Technical ContextAI

libtiff is a widely deployed C library implementing the Tagged Image File Format (TIFF) specification, used across Linux distributions, embedded systems, and server-side image processing stacks. The SamplesPerPixel tag (TIFF tag 277) is a metadata field that declares the number of colour or data channels per pixel (e.g., 3 for RGB, 4 for CMYK). When a crafted TIFF file presents a pathologically large value for this field, libtiff fails to properly validate or bound it before using it in internal calculations or memory operations, triggering a denial-of-service condition - likely via uncontrolled resource consumption, an integer overflow propagating into a memory allocation, or an unbounded loop. No CWE has been formally assigned, but CWE-400 (Uncontrolled Resource Consumption) or CWE-190 (Integer Overflow to Buffer Overflow) are the most probable root cause classes based on the described trigger. CPE data was not provided; affected scope is libtiff versions through 4.7.1 inclusive.

Affected ProductsAI

libtiff version 4.7.1 and all prior versions are stated as affected per the oss-security advisory. No CPE strings were provided. The upstream tracking issue is documented at https://gitlab.com/libtiff/libtiff/-/work_items/781. A fix commit (eedba405d3695b52faae65994c5904f228eca0bf) appears on the GitLab omnibus mirror at https://gitlab.com/gitlab-org/build/omnibus-mirror/libtiff/-/commit/eedba405d3695b52faae65994c5904f228eca0bf; a formal upstream patched release version has not been independently confirmed from the available data.

RemediationAI

The primary remediation is to apply the upstream fix commit eedba405d3695b52faae65994c5904f228eca0bf, available via the libtiff GitLab omnibus mirror. Distribution maintainers (Debian, Red Hat, Ubuntu, Alpine, etc.) should be monitored for backported security updates to their libtiff packages once a formal upstream release is tagged. In the absence of a confirmed patched release version, consider the following compensating controls: restrict or disable TIFF file ingestion at application boundaries (e.g., reject TIFF MIME types or file signatures in upload handlers) - this eliminates the attack surface at the cost of TIFF support; if TIFF processing is mandatory, run the libtiff-consuming process in an isolated container or sandbox with strict resource limits (CPU time, memory cgroup limits) to bound the DoS blast radius; additionally, apply file size limits on ingested images to reduce the feasibility of resource exhaustion. Reference the upstream issue at https://gitlab.com/libtiff/libtiff/-/work_items/781 for patch progress.

More in Gitlab

View all
CVE-2021-22205 CRITICAL POC
10.0 Apr 23

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
CVE-2023-7028 CRITICAL POC
10.0 Jan 12

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
CVE-2013-4490 MEDIUM POC
6.5 May 13

The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
CVE-2022-2992 CRITICAL POC
9.9 Oct 17

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
CVE-2018-18843 CRITICAL POC
10.0 Dec 04

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
CVE-2024-45409 CRITICAL POC
9.8 Sep 10

The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
CVE-2022-1162 CRITICAL POC
9.8 Apr 04

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
CVE-2022-0735 CRITICAL POC
9.8 Mar 28

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
CVE-2021-22175 CRITICAL POC
9.8 Jun 11

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
CVE-2021-22203 CRITICAL POC
9.8 Apr 02

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
CVE-2019-15741 CRITICAL POC
9.8 Sep 16

An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2019-6960 CRITICAL POC
9.8 Sep 09

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-36849 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy