CVE-2026-109398 — Vulnerability intelligence
gumlet — php-image-resize
Published:
- CVSS
- 8.7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.