CVE-2026-109398: Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using composer/gumlet/php-image-resize before version 3.0.1 are exposed when they process attacker-controlled image uploads or other remotely supplied image files.
What does an attacker need to exploit it?
An attacker only needs to provide a small, highly compressed image that expands into a very large bitmap when decoded. No authentication or user interaction is required according to the supplied severity vector.
What is the operational impact of successful exploitation?
Decoding the crafted image can exhaust PHP memory and terminate the worker process, causing denial of service. The supplied vector indicates no confidentiality or integrity impact.
How can I determine whether my application is affected?
Check whether the application depends on composer/gumlet/php-image-resize at a version earlier than 3.0.1 and whether untrusted images reach the ImageResize constructor for processing by GD.