CVE-2026-41309

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41309", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T14:01:46.670Z", "datePublished": "2026-04-24T02:31:52.915Z", "dateUpdated": "2026-04-24T18:17:55.864Z"}, "containers": {"cna": {"title": "Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/security/advisories/GHSA-72qf-xrcw-fhr2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/security/advisories/GHSA-72qf-xrcw-fhr2"}, {"name": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2535", "tags": ["x_refsource_MISC"], "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2535"}, {"name": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/12357113b3be189da7f6e429979a464e4f982117", "tags": ["x_refsource_MISC"], "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/12357113b3be189da7f6e429979a464e4f982117"}], "affected": [{"vendor": "opensource-socialnetwork", "product": "opensource-socialnetwork", "versions": [{"version": "< 9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T02:31:52.915Z"}, "descriptions": [{"lang": "en", "value": "Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted image with extreme pixel dimensions (e.g., $10000 \\times 10000$ pixels). While the compressed file size on disk may be small, the server attempts to allocate significant memory and CPU cycles during the decompression and resizing process, leading to a Denial of Service (DoS) condition. It is highly recommended to upgrade to OSSN 9.0. This version introduces stricter validation of image dimensions and improved resource management during the processing phase. Those who cannot upgrade immediately can mitigate the risk by adjusting their `php.ini` settings to strictly limit `memory_limit` and `max_execution_time` and/or implementing a client-side and server-side check on image headers to reject files exceeding reasonable pixel dimensions (e.g., $4000 \\times 4000$ pixels) before processing begins."}], "source": {"advisory": "GHSA-72qf-xrcw-fhr2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T17:22:06.726940Z", "id": "CVE-2026-41309", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T18:17:55.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41309", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T17:22:06.726940Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T17:22:12.195Z"}}], "cna": {"title": "Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing", "source": {"advisory": "GHSA-72qf-xrcw-fhr2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "opensource-socialnetwork", "product": "opensource-socialnetwork", "versions": [{"status": "affected", "version": "< 9.0"}]}], "references": [{"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/security/advisories/GHSA-72qf-xrcw-fhr2", "name": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/security/advisories/GHSA-72qf-xrcw-fhr2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2535", "name": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2535", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/12357113b3be189da7f6e429979a464e4f982117", "name": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/12357113b3be189da7f6e429979a464e4f982117", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted image with extreme pixel dimensions (e.g., $10000 \\times 10000$ pixels). While the compressed file size on disk may be small, the server attempts to allocate significant memory and CPU cycles during the decompression and resizing process, leading to a Denial of Service (DoS) condition. It is highly recommended to upgrade to OSSN 9.0. This version introduces stricter validation of image dimensions and improved resource management during the processing phase. Those who cannot upgrade immediately can mitigate the risk by adjusting their `php.ini` settings to strictly limit `memory_limit` and `max_execution_time` and/or implementing a client-side and server-side check on image headers to reject files exceeding reasonable pixel dimensions (e.g., $4000 \\times 4000$ pixels) before processing begins."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T02:31:52.915Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41309", "state": "PUBLISHED", "dateUpdated": "2026-04-24T18:17:55.864Z", "dateReserved": "2026-04-20T14:01:46.670Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T02:31:52.915Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "opensource-socialnetwork", "vendor": "opensource-socialnetwork", "versions": [{"status": "affected", "version": "< 9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted image with extreme pixel dimensions (e.g., $10000 \\times 10000$ pixels). While the compressed file size on disk may be small, the server attempts to allocate significant memory and CPU cycles during the decompression and resizing process, leading to a Denial of Service (DoS) condition. It is highly recommended to upgrade to OSSN 9.0. This version introduces stricter validation of image dimensions and improved resource management during the processing phase. Those who cannot upgrade immediately can mitigate the risk by adjusting their `php.ini` settings to strictly limit `memory_limit` and `max_execution_time` and/or implementing a client-side and server-side check on image headers to reject files exceeding reasonable pixel dimensions (e.g., $4000 \\times 4000$ pixels) before processing begins."}], "id": "CVE-2026-41309", "lastModified": "2026-06-17T10:46:28.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41309", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T17:22:06.726940Z", "version": "2.0.3"}}]}, "published": "2026-04-24T03:16:11.720", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/12357113b3be189da7f6e429979a464e4f982117"}, {"source": "security-advisories@github.com", "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2535"}, {"source": "security-advisories@github.com", "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/security/advisories/GHSA-72qf-xrcw-fhr2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.0)"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "opensource-socialnetwork", "source": "cna", "vendor": "opensource-socialnetwork"}, "product": "open_source_social_network", "vendor": "opensource-socialnetwork"}], "analysis": {"en": {"generated_at": "2026-04-28T07:01:36.470172+00:00", "value": {"mitigation_remediation": ["Upgrade to Open Source Social Network 9.0 which implements strict pixel\u2011dimension validation and improved resource limiting", "If an upgrade is not immediately feasible, restrict PHP\u2019s memory_limit and max_execution_time settings to values that constrain the peak memory usage and script run time", "Add server\u2011side validation of image headers to reject files with dimensions exceeding a safe threshold (e.g., 4000\u00d74000 pixels) and, if possible, enforce similar checks on the client side to avoid unnecessary upload traffic"], "summary": {"action": "Immediate Upgrade", "impact": "Denial of Service via resource exhaustion"}, "threat_synthesis": {"affected_systems": "Users running Open Source Social Network versions earlier than 9.0 are affected, regardless of the environment, as the unpatched image processing routine is invoked during normal upload workflows. The vendor is Opensource\u2011Socialnetwork, and the product name is Open Source Social Network.", "description_and_impact": "The vulnerability exists in the image handling component of the Open Source Social Network, where a specially crafted image file with extremely large pixel dimensions can trigger the server to allocate excessive memory and CPU resources during decompression and resizing. The resulting denial of service can affect the availability of the application and any users interacting with it. This weakness is a classic uncontrolled resource consumption problem (CWE\u2011400) coupled with the allocation of resources without limits (CWE\u2011770).", "risk_and_exploitability": "With a CVSS score of 8.2, the vulnerability is considered high severity, and the EPSS score of less than 1% indicates that while exploitation is technically feasible, it is unlikely to be widely automated at this time. The vulnerability is not listed in the CISA KEV catalog, which suggests no widespread, documented exploitation yet. An attacker can exploit it by uploading a malicious image through the web interface, and the attack requires only the ability to submit a file\u2014no special privileges are needed on the target server."}}}}, "created": "2026-04-27T23:00:12.527207+00:00", "updated": "2026-04-28T07:15:19.368772+00:00", "vendors": ["opensource-socialnetwork", "opensource-socialnetwork$PRODUCT$open_source_social_network"]}