CVE-2025-66909 Denial of service in n/a
Attackers can crash the AI serving service by uploading crafted compressed images that cause memory exhaustion, requiring no authentication if the service is public.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66909?
CVE-2025-66909 is a high-severity denial of service vulnerability in n/a, published on 19 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCVImage class in ai/djl/opencv/ExtendedOpenCVImage.java loads images using OpenCV's imread() function without validating dimensions or pixel count before decompression. An attacker can upload a specially crafted compressed image file (e.g., PNG) that is small when compressed but expands to gigabytes of memory when loaded. This causes immediate memory exhaustion, OutOfMemoryError, and service crash. No authentication is required if the OCR service is publicly accessible. Multiple requests can completely deny service availability.
Weakness: CWE-409
Which versions are affected by CVE-2025-66909?
It affects 1 product.
Products include Turms-Im Turms.
How do I fix CVE-2025-66909?
No fix has been published for CVE-2025-66909 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-66909 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66909 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2f87-396w-g74p.