Description

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T16:17:05.397Z",
  "pubdate": "2026-10-12T16:17:05.397Z",
  "executiveSummary": "Gumlet php-image-resize versions prior to 3.0.1 are susceptible to a Denial of Service (DoS) vulnerability triggered by resource exhaustion.\nThe vulnerability arises from the library's failure to impose pixel dimension or memory constraints during the image decoding process within the GD extension.\nBy uploading specially crafted, highly compressed images (often referred to as 'image bombs'), an unauthenticated remote attacker can force the server-side GD library to allocate excessive amounts of memory upon decompression.\nThis excessive memory allocation typically leads to the termination of the PHP worker process, rendering the application service unavailable.\nThe vulnerability poses a high risk to availability, particularly in environments where user-supplied images are processed without prior validation of source dimensions or compression ratios.\nThe exploitation requirement is minimal, necessitating only the ability to upload or process a malicious image file through the affected library interface.",
  "technicalDetails": "The vulnerability is located in the lib/ImageResize.php file, specifically within the constructor of the ImageResize class.\nThe root cause is the lack of sanity checks or constraints on the dimensions of images processed by the underlying PHP GD library's 'imagecreatefrom*' functions (e.g., imagecreatefromjpeg, imagecreatefrompng).\nThese functions decode compressed image data into raw, uncompressed bitmaps in server memory. Because the library does not validate the final pixel dimensions before allocation, an attacker can supply a small compressed file that expands to a massive bitmap, effectively exceeding the configured 'memory_limit' of the PHP process.\nThe attack flow begins when an attacker uploads a 'decompression bomb'—an image file that is small in bytes but contains metadata specifying astronomical dimensions or highly compressed data blocks that trigger massive memory allocation upon decoding.\nWhen the constructor executes the 'imagecreatefrom*' function, the GD library attempts to allocate a buffer proportionate to the decoded pixel count (Width x Height x Bits per Pixel). This allocation happens immediately in the heap.\nIf the resulting memory request exceeds the available PHP 'memory_limit', the script will crash, or if it exceeds system memory, it may trigger an OOM (Out of Memory) killer event, impacting the stability of the entire host or the specific worker pool.\nThis attack requires no prior authentication or administrative privileges, as the entry point is the image processing library utilized by the web application for standard upload or resizing tasks.\nPost-exploitation impact includes persistent service disruption, as repetitive requests can exhaust the process pool, leading to a complete Denial of Service for the application.\nThis issue affects all versions of Gumlet php-image-resize strictly prior to 3.0.1, where input validation logic was likely introduced to sanitize or limit the dimensions of incoming image data before invoking the GD decoding functions."
}