CVE-2026-41309 Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing
Attackers can cause Denial of Service in OSSN by uploading images with extreme dimensions, exhausting server resources during processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41309?
CVE-2026-41309 is a high-severity denial of service vulnerability in opensource-socialnetwork, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted image with extreme pixel dimensions (e.g., $10000 \times 10000$ pixels). While the compressed file size on disk may be small, the server attempts to allocate significant memory and CPU cycles during the decompression and resizing process, leading to a Denial of Service (DoS) condition. It is highly recommended to upgrade to OSSN 9.0. This version introduces stricter validation of image dimensions and improved resource management during the processing phase. Those who cannot upgrade immediately can mitigate the risk by adjusting their `php.ini` settings to strictly limit `memory_limit` and `max_execution_time` and/or implementing a client-side and server-side check on image headers to reject files exceeding reasonable pixel dimensions (e.g., $4000 \times 4000$ pixels) before processing begins.
Which versions are affected by CVE-2026-41309?
How do I fix CVE-2026-41309?
No fix has been published for CVE-2026-41309 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-41309 being exploited?
There is no known exploitation of CVE-2026-41309 in the wild and no public exploit code.
Sources
Also known as GHSA-72qf-xrcw-fhr2.