CVE-2026-70377

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70377", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-04T07:13:07.993Z", "datePublished": "2026-08-05T06:58:47.554Z", "dateUpdated": "2026-08-10T11:44:54.942Z"}, "containers": {"cna": {"title": "imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service", "descriptions": [{"lang": "en", "value": "imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-789 Uncontrolled Memory Allocation", "cweId": "CWE-789", "type": "CWE"}]}], "affected": [{"vendor": "theotherphil", "product": "imagecli", "programFiles": ["src/image_ops.rs"], "versions": [{"version": "0", "lessThanOrEqual": "0.2.1", "versionType": "custom", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "HIGH"}}}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/theotherphil/imagecli/issues/66", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "agrresore", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:54.942Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T06:58:47.554Z"}, "adp": [{"references": [{"url": "https://github.com/theotherphil/imagecli/issues/66", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T13:13:31.920666Z", "id": "CVE-2026-70377", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:14:14.216Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70377", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:13:31.920666Z"}}}], "references": [{"url": "https://github.com/theotherphil/imagecli/issues/66", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:14:10.002Z"}}], "cna": {"title": "imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "agrresore"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "HIGH"}}}, {"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "theotherphil", "product": "imagecli", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.2.1"}], "programFiles": ["src/image_ops.rs"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T06:58:47.554Z", "references": [{"url": "https://github.com/theotherphil/imagecli/issues/66", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.", "supportingMedia": [{"type": "text/html", "value": "<p>imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Uncontrolled Memory Allocation"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:54.942Z"}}}, "cveMetadata": {"cveId": "CVE-2026-70377", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:44:54.942Z", "dateReserved": "2026-08-04T07:13:07.993Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T06:58:47.554Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "imagecli", "programFiles": ["src/image_ops.rs"], "vendor": "theotherphil", "versions": [{"lessThanOrEqual": "0.2.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request."}, {"lang": "es", "value": "La operaci\u00f3n de pipeline \u201cscale [ratio]\u201d de imagecli (Scale::apply() en src/image_ops.rs) calcula el ancho/alto de salida como (dimensi\u00f3n como f32 * ratio) como u32 sin validaci\u00f3n de l\u00edmite superior en la relaci\u00f3n proporcionada por la CLI, que se analiza a trav\u00e9s de nom::number::complete::float sin comprobaci\u00f3n de rango. Una relaci\u00f3n grande (p. ej., 100000) provoca un intento de asignaci\u00f3n de cientos de terabytes, abortando el proceso. Cualquier aplicaci\u00f3n que incruste imagecli como una biblioteca y que acepte cadenas de pipeline controladas por el usuario es remotamente vulnerable a un fallo con una sola solicitud."}], "id": "CVE-2026-70377", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70377", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T13:13:31.920666Z", "version": "2.0.3"}}]}, "published": "2026-08-05T08:16:41.830", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/theotherphil/imagecli/issues/66"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/theotherphil/imagecli/issues/66"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.2.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "imagecli", "source": "cna", "vendor": "theotherphil"}, "product": "imagecli", "vendor": "theotherphil"}], "created": "2026-08-05T08:30:04.506518+00:00", "updated": "2026-08-10T23:15:05.945948+00:00", "vendors": ["theotherphil", "theotherphil$PRODUCT$imagecli"]}