Pixel flood vulnerability

tjko / jpegoptim

jpegoptim - utility to optimize/compress JPEG files

http://www.iki.fi/tjko/projects.html

GNU General Public License v3.0

1.57k stars 116 forks source link

Pixel flood vulnerability #69

Closed r3ggi closed 2 years ago

r3ggi commented 5 years ago

Hey!

I noticed that the latest jpegoptim is vulnerable to pixel flood attack. Due to unlimited memory consumption, uploading a malicious jpg file to a web application that uses jpegoptim, may cause a denial of service.

You can read more on that vulnerability here.

Proof of concept