CVE-2026-53653

Katalog CVE

CVSS 8.7 · High EPSS 0,52%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 4.0 8.7 (High) menurut github.com.

Deskripsi (NVD)

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension or pixel ceiling. This issue is fixed in versions 1.7.53 and 2.0.0-rc.8.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

10 Juli 2026

Status NVD

Deferred

CVSS 4.0

8.7 (High), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/getgrav/grav/commit/d9f9f0369a07ae5c96cde700c7949e1237b29cf6
• https://github.com/getgrav/grav/commit/f4c0f42eea755cedad6f626b342c88d4cba72174
• https://github.com/getgrav/grav/releases/tag/1.7.53
• https://github.com/getgrav/grav/releases/tag/2.0.0-rc.8
• https://github.com/getgrav/grav/security/advisories/GHSA-4x9g-vw65-vvf9