Threat database

CVE-2025-66908 is a medium severity vulnerability in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) related to improper file type validation in the OCR image upload functionality. The system relies solely on client-supplied Content-Type headers and file extensions without verifying actual file content using magic bytes, allowing attackers to upload arbitrary file types including executables or web shells. This can lead to server-side code execution, stored cross-site scripting (XSS), or information disclosure depending on file processing and serving. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type). No known exploits are currently reported in the wild. The CVSS score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. European organizations using affected Turms AI-Serving versions should prioritize validation improvements and restrict file handling to mitigate risks.

CVE-2025-66909 is a high-severity denial of service vulnerability in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier). It arises from improper validation of image dimensions and pixel count during decompression in the ExtendedOpenCVImage class, which uses OpenCV's imread() function. An attacker can upload a crafted compressed image that decompresses to consume excessive memory, causing immediate service crashes due to OutOfMemoryError. No authentication or user interaction is required if the OCR service is publicly accessible, enabling remote attackers to repeatedly trigger service outages. This vulnerability affects availability but does not impact confidentiality or integrity. European organizations using this AI-Serving module in publicly accessible OCR services are at risk of denial of service attacks. Mitigation requires implementing strict validation of image size before decompression, rate limiting, and restricting public access. Countries with higher adoption of AI and OCR technologies in critical infrastructure and services, such as Germany, France, and the UK, are most likely to be affected.

EPSS 0.5%VulnerabilityCWE-409Germany+2