CVE-2026-53653 with a CVSS score of 8.7 is a vulnerability affecting Grav, an unauthenticated denial-of-service vulnerability caused by unbounded image derivative dimensions. An attacker can exhaust server memory and CPU resources by requesting an oversized image resize dimension, causing the host to become unavailable. The issue occurs due to insufficient bounds checking on request-derived dimensions before they are passed to the image processing library, allowing an attacker to force a worker process to allocate several gigabytes of RAM and consume significant CPU resources. The vulnerability affects Grav sites that serve images and requires no authentication, account, or additional plugin. Exploitation can be performed through a GET request containing oversized resize parameters for an image, potentially resulting in service disruption, website downtime, and loss of productivity.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-53653 with a CVSS score of 8.7 is a vulnerability affecting Grav, an unauthenticated denial-of-service vulnerability caused by unbounded image derivative dimensions. An attacker can exhaust server memory and CPU resources by requesting an oversized image resize dimension, causing the host to become unavailable. The issue occurs due to insufficient bounds checking on request-derived dimensions before they are passed to the image processing library, allowing an attacker to force a worker process to allocate several gigabytes of RAM and consume significant CPU resources. The vulnerability affects Grav sites that serve images and requires no authentication, account, or additional plugin. Exploitation can be performed through a GET request containing oversized resize parameters for an image, potentially resulting in service disruption, website downtime, and loss of productivity.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]