{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/gumlet/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gumlet:php-image-resize:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109398"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["php-image-resize (\u003c 3.0.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Gumlet"],"content_html":"\u003cp\u003eThe Gumlet php-image-resize library, specifically versions prior to 3.0.1, contains a denial of service (DoS) vulnerability. The flaw exists within the ImageResize constructor located in 'lib/ImageResize.php'. The component fails to enforce pixel count limits when passing images to the PHP GD library's 'imagecreatefrom*' functions. A remote attacker can exploit this by uploading a small, highly compressed image file that, upon decompression by the GD library, expands into an excessively large bitmap in memory. This process rapidly exhausts the PHP memory limit, causing the worker process to crash or terminate. This vulnerability impacts applications relying on this library for server-side image manipulation and is particularly dangerous in environments that allow unauthenticated or user-supplied image uploads.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the immediate termination of the PHP worker process handling the request. Repeated exploitation can lead to a complete denial of service for the web application, exhausting server resources and preventing legitimate users from accessing services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the 'Gumlet php-image-resize' library to version 3.0.1 or later immediately to include pixel limit enforcement.\u003c/li\u003e\n\u003cli\u003eIn environments where immediate patching is not possible, implement an upstream WAF rule to validate image dimensions before passing files to the PHP backend.\u003c/li\u003e\n\u003cli\u003eConfigure PHP memory limits (memory_limit) to prevent a single request from exhausting total system RAM, though this does not mitigate the application-level worker crash.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:33:58Z","date_published":"2026-10-12T18:33:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-php-image-resize-dos/","summary":"The Gumlet php-image-resize library before 3.0.1 is vulnerable to a denial-of-service condition via memory exhaustion when processing specially crafted image uploads.","title":"Denial of Service Vulnerability in Gumlet php-image-resize","url":"https://feed.craftedsignal.io/briefs/2026-10-php-image-resize-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Gumlet","version":"https://jsonfeed.org/version/1.1"}