CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-109398

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-109398

The Gumlet php-image-resize library (versions before 3.0.1 ) is vulnerable to a Denial of Service (DoS) attack via decompression bombs . The root cause is located in the ImageResize constructor within lib/ImageResize.php, which passes images to GD imagecreatefrom* functions without enforcing pixe...

CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

PT-2026-110627

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...