CVE-2026-70377

Name of the Vulnerable Software and Affected Versions imagecli (affected versions not specified)

Description The scale <ratio> pipeline operation in the Scale::apply() function (located in src/image ops.rs) calculates output dimensions by multiplying the current dimension by a ratio. Because the ratio variable, parsed via nom::number::complete::float, lacks upper-bound validation or range checks, providing an excessively large value can trigger an attempt to allocate hundreds of terabytes of memory. This leads to a process abort, allowing any application that embeds imagecli as a library and accepts user-controlled pipeline strings to be crashed remotely with a single request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.