gumlet CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH gumlet CVE published 2026-10-12

CVE-2026-109398

CVE-2026-109398 is a denial of service vulnerability in Gumlet php-image-resize before version 3.0.1. The vulnerability allows remote attackers to exhaust PHP memory and terminate the worker process by uploading small, highly compressed images that decode to large bitmaps. This issue arises because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pi [truncated]