Gumlet vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Gumlet products: 1 record(s), with severity, exploitation and fixes.

Php-image-resize 1

Exploited only (KEV) →

CVE-2026-109398 High · 7.5 CWE-409 Oct 12, 2026

Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.