CVE-2026-65650

CVE-2026-65650 — PoC: Elgg 아바타 업로드에서의 인증된 DoS 무제한 이미지 치수를 통한 Elgg 아바타 업로드 기능의 인증된 서비스 거부DoS 취약점으로, GD 메모리 고갈을 유발합니다. 영향받는 버전: Elgg saveIconFromUploadedFile'avatar' return elggerrorresponseelggecho'avatar:resize:fail'; PHP의 GD 라이브러리는 디스크의 파일 크기가 아닌 이미지의 디코딩된 픽셀 치수를 기준으로 메모리를 할당합니다. 따라서 극단적인 치수를 가진...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

GHSA-4X9G-VW65-VVF9 Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down. Details Grav::fallbackUrl...

CVE-2026-56741

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS in TelnetIO.java:856-879 reads client-supplied...

CVE-2026-53653 Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request...

GHSA-C7XP-Q6Q8-HG76 Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions

Product: Nuxt OG Image Version: 6.1.2 CWE-ID: CWE-404: Improper Resource Shutdown or Release Description: Failure to limit the length and width of the generated image results in a denial of service. Impact: Denial of service Exploitation condition: An external user Mitigation: Implement a...

Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions

Product: Nuxt OG Image Version: 6.1.2 CWE-ID: CWE-404: Improper Resource Shutdown or Release Description: Failure to limit the length and width of the generated image results in a denial of service. Impact: Denial of service Exploitation condition: An external user Mitigation: Implement a...