CVE-2026-109398GHSA-3g9v-hjrx-mg5h
Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
gumlet php-image-resizeRuntimes & languages
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.0.1php-image-resizeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Text from CVE List
Affected versions 1
- php-image-resizeaffected: all versions before 3.0.1CVE List
References 6
- github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50Fixvia CVE List
- github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2Fixvia CVE List
- github.com/gumlet/php-image-resize/releases/tag/3.0.1Fixvia CVE List
- vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression-bombsAdvisoryvia CVE List
- github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5hExploitvia CVE List
- github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163Referencevia CVE List