CVE-2025-66909

{"id": "CVE-2025-66909", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66909", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-19T15:22:21.847782Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-19T15:15:56.670", "references": [{"url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66909_report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms/blob/develop/turms-ai-serving/src/main/java/ai/djl/opencv/ExtendedOpenCVImage.java#L37", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66909_report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-409"}]}], "descriptions": [{"lang": "en", "value": "Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCVImage class in ai/djl/opencv/ExtendedOpenCVImage.java loads images using OpenCV's imread() function without validating dimensions or pixel count before decompression. An attacker can upload a specially crafted compressed image file (e.g., PNG) that is small when compressed but expands to gigabytes of memory when loaded. This causes immediate memory exhaustion, OutOfMemoryError, and service crash. No authentication is required if the OCR service is publicly accessible. Multiple requests can completely deny service availability."}, {"lang": "es", "value": "El m\u00f3dulo Turms AI-Serving v0.10.0-SNAPSHOT y anteriores contiene una vulnerabilidad de denegaci\u00f3n de servicio por bomba de descompresi\u00f3n de imagen. La clase ExtendedOpenCVImage en ai/djl/opencv/ExtendedOpenCVImage.java carga im\u00e1genes usando la funci\u00f3n imread() de OpenCV sin validar las dimensiones o el recuento de p\u00edxeles antes de la descompresi\u00f3n. Un atacante puede cargar un archivo de imagen comprimido especialmente dise\u00f1ado (por ejemplo, PNG) que es peque\u00f1o cuando est\u00e1 comprimido pero se expande a gigabytes de memoria cuando se carga. Esto causa agotamiento inmediato de la memoria, OutOfMemoryError y ca\u00edda del servicio. No se requiere autenticaci\u00f3n si el servicio OCR es de acceso p\u00fablico. M\u00faltiples solicitudes pueden denegar completamente la disponibilidad del servicio."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9466432E-2863-4A5B-913F-E6E64090F60B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}