THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-4x9g-vw65-vvf9 (high) — Grav: Unauthenticated denial of service via unbounded image derivative dimensions

[GHSA] GHSA-4x9g-vw65-vvf9 (high) — Grav: Unauthenticated denial of service via unbounded image derivative dimensions

medgithub_advisoriesPublished 2026-08-14

GHSA-4x9g-vw65-vvf9 Severity: high CVE: CVE-2026-53653

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

### Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down.

###

Indicators of compromise

CVE-2026-53653cve

Original source: https://github.com/advisories/GHSA-4x9g-vw65-vvf9