Php Image Resize
Monthly
Remote unauthenticated attackers can crash PHP worker processes in applications using Gumlet php-image-resize before 3.0.1 by submitting small, heavily compressed image files that expand into very large bitmaps when decoded by GD, exhausting the PHP memory limit and terminating the worker. Any upload or URL-fetch feature that hands untrusted images to the ImageResize constructor is exposed; the impact is availability-only, affecting individual PHP-FPM workers rather than enabling code execution or data disclosure. Severity is rated 8.7 (CVSS 4.0) and an independent assessment concurs on a high availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but the attack is trivial to construct and the vendor characterizes this as a genuine availability risk rather than an emergency.
Remote unauthenticated attackers can crash PHP worker processes in applications using Gumlet php-image-resize before 3.0.1 by submitting small, heavily compressed image files that expand into very large bitmaps when decoded by GD, exhausting the PHP memory limit and terminating the worker. Any upload or URL-fetch feature that hands untrusted images to the ImageResize constructor is exposed; the impact is availability-only, affecting individual PHP-FPM workers rather than enabling code execution or data disclosure. Severity is rated 8.7 (CVSS 4.0) and an independent assessment concurs on a high availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but the attack is trivial to construct and the vendor characterizes this as a genuine availability risk rather than an emergency.