CVE-2026-55497

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0

Description Cloudreve contains an issue where the built-in image decoders for PNG, JPEG, and GIF formats limit only the compressed file size but do not restrict the decoded pixel dimensions. An authenticated user can upload a small image file that declares enormous dimensions in its header, forcing the system to attempt a multi-gigabyte memory allocation. This leads to a fatal out-of-memory condition that terminates the entire Cloudreve process, resulting in a complete loss of availability for all users.

This can be triggered through two primary paths:

The issue occurs because the NewThumbFromFile() function uses standard Go library decoders that allocate pixel buffers based on the image header without an upper bound on width or height variables.

Recommendations Update Cloudreve to version 4.17.0. As a temporary mitigation, restrict the use of the PUT /api/v4/user/setting/avatar endpoint or disable the built-in thumbnail generator in the system settings.