CVE-2026-109324 in Grav
Summary
by MITRE • 10/12/2026
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability in Grav versions prior to 2.1.7 represents a critical denial of service flaw rooted in improper handling of image processing operations during media upload and transformation workflows. This issue specifically affects authenticated users with the role of media author, allowing them to craft malicious requests that trigger excessive memory consumption on the server side. The core technical failure lies within the integration between Grav’s Twig templating engine or Markdown parser and underlying PHP image libraries such as GD or Imagick. When a user uploads a compressed raster image alongside specific transformation directives, these libraries are instructed to decode the full source data into memory for processing. Crucially, this decoding process occurs without adequate dimension checks or size validation prior to allocation. This oversight means that an attacker can supply images with deceptive compression ratios where the uncompressed dimensions are vastly larger than what is visually apparent in the compressed file format.
The operational impact of this vulnerability is severe, as it enables a remote denial of service attack against Grav-based websites. By repeatedly uploading these oversized raster images and referencing them through Twig or Markdown transforms, an attacker can force the server to allocate massive amounts of memory for each request. Since the image libraries decode the full source without verifying if the resulting dimensions are reasonable or within expected bounds, even a single such upload can consume significant system resources. When executed repeatedly by anonymous requests following initial authentication setup, this behavior leads to rapid exhaustion of available RAM on the hosting environment. This resource depletion results in page unavailability for legitimate users and potentially causes server crashes or instability if memory limits are not strictly enforced at the web server level rather than within the application logic itself.
From a classification perspective, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption, as the system fails to limit the amount of resources consumed by user-controlled input. It also relates to CWE-787 Out-of-bounds Write if the memory allocation leads to buffer overflows in lower-level libraries, though primarily it is a resource exhaustion issue. In terms of attack vectors, this falls under ATT&CK technique T1496 Resource Hijacking, where an attacker uses computing resources for their own purposes or causes disruption by exhausting system capacity. The vulnerability highlights the risks associated with trusting image processing libraries to handle arbitrary inputs without explicit validation layers in the application code.
To mitigate this risk, administrators running Grav versions prior to 2.1.7 should upgrade immediately to version 2.1.7 or later where these dimension checks and resource limits have been implemented. For environments that cannot be upgraded instantly, implementing strict server-level memory limits for PHP processes can help contain the impact of such attacks by terminating scripts that exceed allocated thresholds before they bring down the entire system. Additionally, configuring web servers to limit request sizes and employing rate limiting on upload endpoints can reduce the frequency with which an attacker can trigger these resource-intensive operations. It is also advisable to validate image dimensions server-side using lightweight checks before passing them to heavy libraries like GD or Imagick for full decoding.