CVE-2026-109398

{
  "etk_id": "ETK-2026-1379",
  "cve_id": "CVE-2026-109398",
  "display_id": "CVE-2026-109398",
  "ghsa_id": "GHSA-3g9v-hjrx-mg5h",
  "euvd_id": "EUVD-2026-97495",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Memory-exhaustion denial of service in gumlet php-image-resize",
  "summary": "php-image-resize versions earlier than 3.0.1 can use excessive PHP memory while processing compressed images that expand to very large decoded dimensions. An attacker who can submit an image for processing may cause a PHP worker to terminate.",
  "mitigation": "Upgrade php-image-resize to version 3.0.1 or later. Restrict untrusted image uploads until the upgrade is deployed.",
  "vendor": "gumlet",
  "product": "php-image-resize",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.0.1"
      ],
      "package_name": "php-image-resize",
      "purl": null
    }
  ],
  "cwes": [
    409
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0045,
  "epss_percentile": 0.3805,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.135587333333334,
  "t0_at": "2026-10-12T15:16:43.793000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T15:16:43.793000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T15:16:43.793000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109398"
    }
  }
}