CVE-2026-109398
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php p
CVSS
7.5
High
EPSS
0.5%
p38
KEV
—
Exploit Today
12
0-100
Published: Oct 12, 2026 · Last modified: Oct 16, 2026 · CWE-409
0.5%EPSS · 30 days0.5%
2026-10-132026-10-23
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
- github.comhttps://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163
- github.comhttps://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50
- github.comhttps://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2
- github.comhttps://github.com/gumlet/php-image-resize/releases/tag/3.0.1
- github.comhttps://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h
- www.vulncheck.comhttps://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression-bombs
- github.comhttps://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5h
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1156384.3 MED10.9%
——3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.11hCVE-2026-1155035.5 MED1.8%
——1Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.14hCVE-2026-1153965.5 MED1.8%
——1Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.14hCVE-2026-1138737.5 HIG26.7%
——8SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.12hCVE-2026-93471—37.1%
——11Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.
This issue affects esaml: from 0.1.0 onward.2dCVE-2026-96637—25.4%
——8Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.9h