{"metadata": {"vulnerability": "CVE-2026-109398", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-06T18:18:16Z", "date_only": false, "value": "2026-10-06T18:18:16.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109398", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:40:48.402Z", "date_only": false, "value": "2026-10-12T14:40:48.402Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109398", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T15:16:43.793Z", "date_only": false, "value": "2026-10-12T15:16:43.793Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109398", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T15:16:43.793Z", "date_only": false, "value": "2026-10-12T15:16:43.793Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109398", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T15:38:08.540Z", "date_only": false, "value": "2026-10-12T15:38:08.540172Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117428681929964640", "record": "CVE-2026-109398", "field": "creation_timestamp", "uuid": "591ff612-4a7e-4ec7-80cc-46e857d1b08d", "content": "CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109398https://github.com/gumlet/php-image-resize/security/advisories/GHSA-3g9v-hjrx-mg5hhttps://github.com/gumlet/php-image-resize/commit/10c1f386e672536d82be0f39b236a80d87767a50https://github.com/gumlet/php-image-resize/commit/cd01c9e8aa2382211d760c825799c8102987a8c2https://github.com/gumlet/php-image-resize/blob/3.0.0/lib/ImageResize.php#L122-L163https://github.com/gumlet/php-image-resize/releases/tag/3.0.1https://www.vulncheck.com/advisories/gumlet-php-image-resize-before-3.0.1-denial-of-service-via-decompression-bombs#gumlet #php-image-resize#CVE_2026_109398#bot", "url": "https://infosec.exchange/users/cve/statuses/117428681929964640"}, {"timestamp": "2026-10-12T16:17:05Z", "date_only": false, "value": "2026-10-12T16:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F678-5VXR-2R99", "record": "GHSA-F678-5VXR-2R99", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T16:17:05.397Z", "date_only": false, "value": "2026-10-12T16:17:05.397", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109398", "record": "FKIE_CVE-2026-109398", "field": "published"}, {"timestamp": "2026-10-12T18:31:34Z", "date_only": false, "value": "2026-10-12T18:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F678-5VXR-2R99", "record": "GHSA-F678-5VXR-2R99", "field": "published"}, {"timestamp": "2026-10-12T18:31:34Z", "date_only": false, "value": "2026-10-12T18:31:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F678-5VXR-2R99", "record": "GHSA-F678-5VXR-2R99", "field": "modified"}, {"timestamp": "2026-10-13T18:20:05.846Z", "date_only": false, "value": "2026-10-13T18:20:05.846510Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109398", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T18:20:05.846Z", "date_only": false, "value": "2026-10-13T18:20:05.846510Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109398", "record": "FKIE_CVE-2026-109398", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T18:20:30.276Z", "date_only": false, "value": "2026-10-13T18:20:30.276Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109398", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T18:20:30.276Z", "date_only": false, "value": "2026-10-13T18:20:30.276Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109398", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:44:17Z", "date_only": false, "value": "2026-10-16T17:44:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/198041", "record": "CVE-2026-109398", "field": "creation_timestamp", "uuid": "6058bb04-7f3f-4b91-b003-77d986d11665", "content": "How a 56KB PNG Brought Down a Library with Millions of Downloads (CVE-2026\u2013109398)\nhttps://medium.com/@shaikikram2005/how-a-56kb-png-brought-down-a-library-with-millions-of-downloads-cve-2026-109398-b7826d4f38a0?source=rss------bug_bounty-5", "url": "https://t.me/hacking_Attack/198041"}, {"timestamp": "2026-10-16T17:44:17Z", "date_only": false, "value": "2026-10-16T17:44:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/198043", "record": "CVE-2026-109398", "field": "creation_timestamp", "uuid": "e3c603cb-25df-4530-9266-01c4548c63ae", "content": "By Ikram (@Ikram-4)Continue reading on Medium \u00bb (https://medium.com/@shaikikram2005/how-a-56kb-png-brought-down-a-library-with-millions-of-downloads-cve-2026-109398-b7826d4f38a0?source=rss------bug_bounty-5)", "url": "https://t.me/hacking_Attack/198043"}, {"timestamp": "2026-10-16T19:21:14.417Z", "date_only": false, "value": "2026-10-16T19:21:14.417", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109398", "record": "FKIE_CVE-2026-109398", "field": "lastModified"}]}