CVE-2026-109398 Details
Description
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
A denial-of-service vulnerability has been identified in Gumlet PHP Image Resize versions prior to 3.0.1. The issue arises because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without any pixel limits. This allows remote attackers to upload small, highly compressed images that, when decoded, become large bitmaps. Such exploitation can exhaust PHP memory, leading to termination of the worker process.
Users can update to Gumlet PHP Image Resize version 3.0.1 or later, where this vulnerability has been fixed. Instructions for updating can be found in the GitHub repository's release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163 | [email protected] | Source CodeVendor |
| https://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50 | [email protected] | Source CodeVendor |
| https://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2 | [email protected] | Source CodeVendor |
| https://github.com/gumlet/php-image-resize/releases/tag/3.0.1 | [email protected] | Release NotesVendor |
| https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression-bombs | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gumlet php-image-resize | <= 3.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |