The vulnerability exists in Grav's image processing where the fallbackUrl() method processes query parameters for image resizing actions without limiting the requested dimensions. Specifically, the forceResize action sets output image size directly from user input without clamping. The underlying GD library allocates memory outside PHP's memory limits, allowing attackers to exhaust server RAM and CPU by requesting very large image sizes (e.g., 20000x20000 pixels). This results in denial of service for any Grav site serving images. The issue affects versions prior to 1.7.53 and the 2.0.0-rc.8 release candidate. A patch introduces a configurable maximum dimension (default 8000) to reject oversized requests at the request boundary.

An unauthenticated attacker can cause a denial of service on any Grav site serving images by exhausting server memory and CPU resources through oversized image resize requests. This can crash the server or severely degrade performance. No authentication or special configuration is required to exploit this vulnerability.

A patch is available that adds a configurable maximum dimension limit (default 8000) for image resize requests, rejecting requests exceeding this limit before processing. Operators should apply this patch or upgrade to a fixed version. The vendor advisory recommends bounding the resize arguments at the request boundary rather than relying on the image library. No other mitigation is indicated.