CVE-2026-109324: Improper Handling of Highly Compressed Data (Data Amplification) in getgrav grav
Description
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.
CVSS v4.0
Score 7.1high
Affected software
getgrav
grav
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109324 describes a denial of service vulnerability in Grav prior to version 2.1.7. The flaw arises from improper handling of highly compressed raster images uploaded by authenticated media authors. When these images are referenced in Twig or Markdown transforms, the GD or Imagick image processing libraries decode the full source without verifying image dimensions. This allows attackers to cause memory exhaustion, resulting in denial of service conditions accessible even to anonymous users through repeated requests.
Potential Impact
An attacker with authenticated media author privileges can upload maliciously crafted compressed images that consume excessive memory during processing. This leads to denial of service by making pages unavailable to users. The vulnerability can be triggered by anonymous users referencing these images, amplifying the impact. The CVSS 4.0 score is 7.1 (high severity), indicating a significant risk of service disruption.
Mitigation Recommendations
A fix is available in Grav version 2.1.7 and later. Users should upgrade to version 2.1.7 or above to remediate this vulnerability. Until upgraded, restrict media author privileges and monitor for suspicious uploads. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:15:29.012Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c152cdf04f656b11bfa
Added to database: 10/12/2026, 16:34:29 UTC
Last enriched: 10/12/2026, 17:04:12 UTC
Last updated: 10/12/2026, 21:46:46 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.