https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:01:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343335 EUVD-2026-343335 https://cve.radiocsirt.org/vuln/euvd-2026-343335 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55497 <p>Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded allocation and terminates the Cloudreve process through fatal out-of-memory behavior. This issue is fixed in version 4.17.0.</p> <p>Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded allocation and terminates the Cloudreve process through fatal out-of-memory behavior. This issue is fixed in version 4.17.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55497 https://cve.radiocsirt.org/vuln/ghsa-g9j2-8w95-3vwv <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4, Go: github.com/cloudreve/Cloudreve/v3</p> <p>## Summary</p> <p>Cloudreve&#39;s built-in image processor decodes user-supplied images with Go&#39;s standard-library decoders (`image/png`, `image/jpeg`, `image/gif`) and guards **only the compressed file size** — never the *decoded* pixel dimensions. Go&#39;s decoders allocate a pixel buffer sized `bytesPerPixel × width × height` taken straight from the image header (e.g. a PNG&#39;s IHDR), with no upper bound on `width`/`height`. A tiny (tens-of-bytes) image that *declares* enormous dimensions therefore forces a multi-gigabyte-to-terabyte allocation (`make([]uint8, …)`), exhausting memory. The resulting out-of-memory condition is a **fatal Go runtime error / kernel OOM-kill that `recover()` cannot catch**, terminating the whole Cloudreve process for all users.</p> <p>Two reachable sinks share the same root cause:</p> <p>1. **Avatar upload** (`PUT /api/v4/user/setting/avatar`) — decodes synchronously in the request handler. Any authenticated user. **Cleanest single-request PoC.** 2. **Thumbnail generation** (built-in generator, **enabled by default**) — decodes in the thumbnail queue worker. Reachable for the user&#39;s own files *and* for files inside a share, so a planted bomb can be (re)triggered through a public share link.</p> <p>Post-auth, low privilege. A single 65-byte upload deterministically takes the instance offline.</p> <p>### Details ### Root cause — decode guarded by file size, not pixel count</p> <p>The built-in generator is the **default** image thumbnailer:</p> <p>```go // inventory/setting.go @ 26b6b10 &#34;thumb_bui…</p> <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4, Go: github.com/cloudreve/Cloudreve/v3</p> <p>## Summary</p> <p>Cloudreve&#39;s built-in image processor decodes user-supplied images with Go&#39;s standard-library decoders (`image/png`, `image/jpeg`, `image/gif`) and guards **only the compressed file size** — never the *decoded* pixel dimensions. Go&#39;s decoders allocate a pixel buffer sized `bytesPerPixel × width × height` taken straight from the image header (e.g. a PNG&#39;s IHDR), with no upper bound on `width`/`height`. A tiny (tens-of-bytes) image that *declares* enormous dimensions therefore forces a multi-gigabyte-to-terabyte allocation (`make([]uint8, …)`), exhausting memory. The resulting out-of-memory condition is a **fatal Go runtime error / kernel OOM-kill that `recover()` cannot catch**, terminating the whole Cloudreve process for all users.</p> <p>Two reachable sinks share the same root cause:</p> <p>1. **Avatar upload** (`PUT /api/v4/user/setting/avatar`) — decodes synchronously in the request handler. Any authenticated user. **Cleanest single-request PoC.** 2. **Thumbnail generation** (built-in generator, **enabled by default**) — decodes in the thumbnail queue worker. Reachable for the user&#39;s own files *and* for files inside a share, so a planted bomb can be (re)triggered through a public share link.</p> <p>Post-auth, low privilege. A single 65-byte upload deterministically takes the instance offline.</p> <p>### Details ### Root cause — decode guarded by file size, not pixel count</p> <p>The built-in generator is the **default** image thumbnailer:</p> <p>```go // inventory/setting.go @ 26b6b10 &#34;thumb_bui…</p> https://cve.radiocsirt.org/vuln/ghsa-g9j2-8w95-3vwv