Live › vulnerability › CVE-2026-112782
Go to dashboardGrav CMS builds image canvases in GD from URL parameters without enforcing its pixel limit when url_actions is on. An anonymous visitor can request huge resize or crop sizes and make the server allocate gigabytes of memory, taking the site down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
1.7.53.5 or later, or Grav 2.x to 2.2.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
This page as .md · .json · in your agent: get_signal("CVE-2026-112782")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.