Gumlet php-image-resize: Denial of service via image bombs
Summary
The php-image-resize PHP library does not limit the pixel size of images before decoding them. A remote attacker can upload a small, highly compressed image that expands into a very large bitmap, exhausting PHP memory and terminating the worker process. The attack requires no authentication and no user interaction, but only affects applications that pass untrusted images to the library.
Affected
- gumlet/php-image-resize (Composer) versions before 3.0.1
- Version 2.x: Unknown.
Fixed in
- Version 3.0.1 (released 2026-10-06) adds a pixel count check through the new property $max_source_pixels (default 15,000,000 pixels).
Workaround
- Validate uploads before they reach the library: enforce maximum width, height, pixel count and file size.
- Restrict who can upload images where possible.
- Do not set $max_source_pixels to 0 for untrusted input.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- No evidence of active exploitation in the wild found. Not listed in CISA KEV (not independently verified).
- No public proof of concept identified.
Our recommendation
- Update gumlet/php-image-resize to version 3.0.1 or later.
- Check whether public PHP applications use this library on upload or image processing endpoints.
- Until patched, apply input validation and upload limits as described under workaround.
- Monitor PHP-FPM logs for memory exhaustion errors and worker restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3g9v-hjrx-mg5h github.com
- GitHub Release 3.0.1 github.com
- Fix commit 10c1f386 github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-109398 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:51.
Original description (NVD)
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
NVD references (7)
- https://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163
- https://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50
- https://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2
- https://github.com/gumlet/php-image-resize/releases/tag/3.0.1
- https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h
- https://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression…
- https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.