CVE-2026-109398 gumlet CVE debrief

Who should care

Defenders responsible for maintaining and securing PHP applications using the Gumlet php-image-resize library should assess exposure and prioritize upgrading to version 3.0.1 or later.

Why it matters

CVE-2026-109398 is a denial of service vulnerability in Gumlet php-image-resize before version 3.0.1 that allows remote attackers to exhaust PHP memory and terminate the worker process by uploading small, highly compressed images that decode to large bitmaps.

• Denial of service attacks can exhaust PHP memory and terminate the worker process
• Potential for remote attackers to upload malicious images
• Need to validate image uploads to prevent potential denial of service attacks
• Upgrade to version 3.0.1 or later to fix the vulnerability

Technical summary

The ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits, allowing remote attackers to upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process. This vulnerability affects Gumlet php-image-resize before version 3.0.1 and can be mitigated by upgrading to version 3.0.1 or later and validating image uploads to prevent potential denial of service attacks. Defenders should prioritize these actions to minimize exposure.

Defensive priority

Defenders should prioritize upgrading to version 3.0.1 or later and validating image uploads to prevent potential denial of service attacks.

Recommended defensive actions

• Upgrade to version 3.0.1 or later
• Validate image uploads to prevent potential denial of service attacks
• Monitor PHP memory usage to detect potential attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the ImageResize constructor in lib/ImageResize.php passing images to GD imagecreatefrom* functions without pixel limits. This allows remote attackers to upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.