CVE-2026-112782
7.5HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote, unauthenticated attackers can crash the site via denial-of-service by sending specially crafted image URLs that exhaust server memory. They only need network access to any Grav site with image URL actions enabled.
Root cause
Image processing routines fail to enforce the max_pixels limit on certain single-dimension, percentage-based, or chained actions, allowing the GD library to allocate massive memory canvases.
Affected systems
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade Grav to version 1.7.53.5 or 2.2.2. If patching immediately is not possible, disable URL-based image processing by setting system.images.url_actions to false in user/config/system.yaml.
$ bin/gpm selfupgradeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.