High · published December 19, 2025
⚡ An image upload could take your entire service down! This Denial of Service vulnerability in Turms AI-Serving module v0.10.0-SNAPSHOT and earlier allows attackers to exploit unvalidated image decompression, causing chaos with just one crafty PNG. 🔥 Think of it as a tiny package that holds a never-ending supply of balloons. When you open it, the balloons flood your room and completely take over, leaving no space to breathe. That's what happens when an attacker uploads a deceptively small image that expands to gigabytes, exhausting all your server's memory. This vulnerability can lead to immediate memory exhaustion, throwing OutOfMemoryErrors your way and crashing your service. If the OCR service is publicly accessible, an attacker can launch multiple requests to render your service entirely unavailable, creating a frustrating experience for users and potential downtime for your operations.
Think of it as a tiny package that holds a never-ending supply of balloons. When you open it, the balloons flood your room and completely take over, leaving no space to breathe. That's what happens when an attacker uploads a deceptively small image that expands to gigabytes, exhausting all your server's memory. In the ExtendedOpenCVImage class of Turms AI-Serving, images are loaded using OpenCV's imread() function without checking the dimensions or pixel count beforehand. This oversight allows a specially crafted compressed image file to consume massive amounts of memory upon decompression, leading to a Denial of Service.
This vulnerability can lead to immediate memory exhaustion, throwing OutOfMemoryErrors your way and crashing your service. If the OCR service is publicly accessible, an attacker can launch multiple requests to render your service entirely unavailable, creating a frustrating experience for users and potential downtime for your operations. Update the Turms AI-Serving module to version v0.10.1 or later, where this vulnerability is patched. Implement image validation checks to ensure that dimensions and pixel counts are within acceptable limits before processing any uploaded images. You might also consider rate limiting image uploads to mitigate potential abuse. You've got this! With these steps, you'll be back in control of your service in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| turms-im/turms | all versions | — |