CVE-2025-66909

Turms AI-Serving module prior to v0.10.0 is affected by an image decompression bomb DoS. The ExtendedOpenCVImage class uses OpenCV imread() without validating image dimensions or pixel count before decompression, allowing a crafted compressed image (e.g., PNG) to expand to gigabytes in memory, ca...