CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
Remote attackers can cause denial of service by uploading decompression bombs that exhaust PHP memory in the Gumlet php-image-resize library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109398?
CVE-2026-109398 is a high-severity denial of service vulnerability in gumlet php-image-resize, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.
Weakness: CWE-409
Which versions are affected by CVE-2026-109398?
How do I fix CVE-2026-109398?
No fix has been published for CVE-2026-109398 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-109398 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109398 exists.
Sources
Also known as GHSA-3g9v-hjrx-mg5h, GHSA-f678-5vxr-2r99.