CVE-2026-109398

Executive Summary

CVE-2026-109398 is a denial-of-service vulnerability in the Gumlet php-image-resize library prior to version 3.0.1, in which the ImageResize constructor in lib/ImageResize.php passes attacker-supplied images to GD imagecreatefrom* functions without enforcing pixel limits. Any application that exposes this library to untrusted image uploads is affected. The impact is availability-only: a remote, unauthenticated attacker can submit a small, highly compressed image that decodes into a very large bitmap, exhausting PHP worker memory and terminating the process.

Technical Analysis

The vulnerability resides in the image ingestion path of the Gumlet php-image-resize library. According to the available description, the ImageResize constructor in lib/ImageResize.php forwards image data to GD's imagecreatefrom* family of functions without applying any pixel-count or decoded-dimension ceiling.

GD's imagecreatefrom* functions allocate memory proportional to the decoded raster dimensions, not the size of the compressed input file. Image formats capable of very high compression ratios (for example, formats that tolerate large runs of identical pixels or decode into fixed large buffers) can therefore act as a memory amplification vector: a compact payload of only a few kilobytes can, upon decoding, demand hundreds of megabytes to low gigabytes of contiguous memory.

Because the constructor performs no pre-decode validation of the image's declared width, height, or total pixel count, the allocation request is issued unconditionally. When the allocation exceeds PHP's configured memory_limit, the interpreter raises a fatal error and the worker process terminates. In concurrent or queue-driven deployments, repeated submissions can be used to drive sustained worker churn, degrading or removing image-processing capability for legitimate users.

The weakness is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). The attack surface is any endpoint, job handler, or CLI worker that accepts user-controlled image content and routes it into the library's constructor without upstream dimension checks.

The CVSS v3.1 vector — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — describes an unauthenticated, network-reachable, low-complexity attack that compromises availability with high severity while leaving confidentiality and integrity unaffected. It reflects a clean memory-exhaustion DoS: no information disclosure, no code execution, no scope change. The base score of 7.5 is consistent with this profile.

No information is available on the specific maximum decoded dimensions GD tolerates or any upstream validation the library may perform before the constructor, and none should be assumed beyond what is documented above. No public proof-of-concept, exploit code, or Nuclei template exists for this CVE, and it has not been added to CISA KEV. FIRST.org has not yet assigned an EPSS score.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (data amplification / memory exhaustion via image decode).

1. Reconnaissance / target identification. The attacker identifies a PHP application that accepts uploaded images and uses the Gumlet php-image-resize library (for example, avatar, thumbnail, or media-processing endpoints). Public code search, dependency manifests, or error messages that reference the library can aid identification. No authentication is required for the subsequent steps.

2. Triggering the flaw class. The attacker crafts a small image file whose compressed size is minimal but whose decoded dimensions are very large. Because the ImageResize constructor calls GD's imagecreatefrom* functions without a pixel limit, the file passes any shallow size-based or MIME checks and is submitted to the vulnerable code path.

3. Payload delivery. The malicious image is submitted through the normal upload interface, multipart form field, or API endpoint that feeds the process-and-resize pipeline. No special privileges or crafted protocol exploitation is needed — the vulnerability is reached through ordinary use of the public image-upload functionality.

4. Post-exploitation impact. During decode, GD allocates memory proportional to the decoded bitmap dimensions. When the allocation exceeds PHP's memory_limit, the worker process terminates with a fatal error. Repeated submissions — sequential or concurrent — consume available worker capacity, so legitimate image processing and, in shared-worker pools, unrelated request handling suffer elevated latency or outright failure. The impact is confined to availability; no code execution, data exfiltration, or persistent foothold is achieved by this flaw alone.

Impact Assessment

The blast radius is any deployment that exposes php-image-resize to untrusted image content: user avatar systems, CMS media pipelines, e-commerce product-image processing, social platforms, and API gateways that accept image uploads. Because the attack requires no authentication and no user interaction (PR:N/UI:N), the effective attack surface equals the entire set of public image-ingestion endpoints.

CVSS subscores quantify the impact profile:

• Availability (A:H): High — successful exploitation terminates PHP workers and removes image-processing capability.
• Confidentiality (C:N) / Integrity (I:N): None — the flaw neither exposes nor alters data.
• Attack Vector (AV:N), Complexity (AC:L), Privileges (PR:N), User Interaction (UI:N): The attacker needs only network reach to an upload endpoint and a specially crafted small file.
• Scope (S:U): Unchanged — impact stays within the vulnerable component's security authority.

Business consequences include degraded or unavailable image-dependent features, potential cascading failures in queue-backed architectures where a poison image repeatedly crashes each worker that dequeues it, and elevated infrastructure cost if autoscaling responds to crash-driven retries. In high-volume environments, sustained worker exhaustion can approximate a full service outage for the affected functionality without any resource-intensive demand from the attacker. There is currently no confirmed in-the-wild exploitation and no KEV listing.

Detection Guidance

Sigma Rule

title: Gumlet php-image-resize Decompression Bomb Memory Exhaustion Attempt
id: 8b2f4c1e-1093-9826-abcd-90ef12ab34cd
status: experimental
description: Detects PHP Fatal memory exhaustion errors in worker logs following image processing, consistent with CVE-2026-109398 decompression-bomb DoS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109398
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: application
detection:
  selection_php:
    - 'Allowed memory size of * bytes exhausted'
    - 'imagecreatefrom*'
  selection_context:
    - 'ImageResize'
    - 'php-image-resize'
    - 'GD'
  condition: selection_php and selection_context
falsepositives:
  - Legitimate large image uploads in low-memory environments
  - Unrelated PHP memory exhaustion from other code paths
level: medium
tags:
  - attack.t1190
  - cwe.409

YARA Rule

rule CVE_2026_109398_Image_Decompression_Bomb
{
    meta:
        description = "Detects uploaded image files with extreme decoded-dimension-to-file-size ratios consistent with the php-image-resize DoS (CWE-409)."
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109398"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $png = { 89 50 4E 47 0D 0A 1A 0A }
        $gif87 = "GIF87a"
        $gif89 = "GIF89a"
        $jpg = { FF D8 FF }

    condition:
        filesize < 200KB and
        ($png at 0 or $gif87 at 0 or $gif89 at 0 or $jpg at 0)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109398 Gumlet php-image-resize Potential Decompression Bomb Upload"; flow:to_server,established; http.method; content:"POST"; http.header; content:"Content-Type|3a 20|multipart/form-data"; http.request_body; content:"|89 50 4E 47 0D 0A 1A 0A|"; http.request_body; content:"|FF D8 FF|"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-109398; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109398; sid:2026109398; rev:1;)

Elastic Detection

sequence by host.id with maxspan=2m
  [ process where process.name == "php" and process.args_count > 0 ]
  [ log where message : "Allowed memory size of * bytes exhausted" and message : "imagecreatefrom*" ]

Splunk SPL Query

index=web OR index=php sourcetype=php_errorlog OR sourcetype=nginx:error
| search ("Allowed memory size" AND ("exhausted" OR "imagecreatefrom"))
| rex field=_raw "(?<alloc>Allowed memory size of (?<mem>\d+) bytes)"
| stats count as crash_count, values(host) as hosts, values(mem) as mem_limits by src_ip, uri_path
| where crash_count >= 3
| sort - crash_count

Wazuh OSSEC Rule

<group name="web,app,image_resize,">
  <rule id="109398" level="10">
    <decoded_as>json</decoded_as>
    <match>Allowed memory size of</match>
    <match>exhausted</match>
    <match>imagecreatefrom</match>
    <description>CVE-2026-109398: PHP memory exhaustion during image processing (decompression bomb DoS) detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,image_resize,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no code change required):

   • Bound the decoded dimensions of any image before it reaches the library. Prefer reading only the image header (e.g., via getimagesize()-equivalent header inspection) to enforce a maximum width, height, and total pixel count, rejecting anything that exceeds policy.
   • Cap memory_limit reasonably and isolate image processing in a dedicated PHP-FPM pool / worker container with process-level memory and CPU limits so a single poison image cannot affect unrelated workers.
   • Apply upstream reverse-proxy body-size limits and rate-limit upload endpoints per source.
   • Run image decoding in an out-of-process sandbox or separate container with a hard memory cap and automatic restart.

2. Patch / upgrade steps:

   • The description references Gumlet php-image-resize 3.0.1 as the fixed release. Treat this as unverified: no patch evidence exists in tracked sources. Before relying on 3.0.1, confirm the fix by reviewing the release changelog, the diff against the vulnerable ImageResize constructor in lib/ImageResize.php, and commit history.
   • If the dependency is vendored, pin to the confirmed fixed version and redeploy; rebuild container images and clear opcache.
   • Update composer.json/composer.lock and rerun dependency resolution to eliminate the vulnerable version from the tree.

3. Long-term hardening:

   • Add pixel-dimension and decode-ratio validation as a reusable pre-processing middleware for all image ingestion paths.
   • Enforce memory ceilings on all PHP workers and treat image pipelines as untrusted-input boundaries.
   • Add continuous dependency scanning (SCA) to flag php-image-resize versions prior to 3.0.1.
   • Monitor worker crash rates and correlate spikes with upload endpoint traffic.

References

• NVD — CVE-2026-109398: https://nvd.nist.gov/vuln/detail/CVE-2026-109398
• MITRE CWE-409 — Improper Handling of Highly Compressed Data / Data Amplification: https://cwe.mitre.org/data/definitions/409.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — currently unscored for this CVE: https://www.first.org/epss/
• CISA KEV Catalog — CVE-2026-109398 is not listed as of this report: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public proof-of-concept, or Nuclei template have been identified for this CVE.