CVE-2026-65650: Elgg DoS Vulnerability via Avatar Upload

CVE-2026-65650 Overview

CVE-2026-65650 affects Elgg, an open-source social networking engine, in versions before 7.0.0. The application does not validate image dimensions during avatar upload. An authenticated user can upload an avatar with excessive dimensions, forcing the server-side image resizer to allocate large amounts of memory. This condition triggers out-of-memory (OOM) errors and can render the application unavailable to legitimate users. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling and was fixed in Elgg 7.0.0.

Critical Impact
An authenticated attacker can trigger a denial-of-service condition by uploading avatar images with excessive dimensions, exhausting server memory during resize operations.

Affected Products

Elgg versions prior to 7.0.0
Elgg 7.0.0-rc.1 and earlier release candidates
Deployments using the default GD or Imagick image processor without dimension limits

Discovery Timeline

2026-07-22 - CVE-2026-65650 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65650

Vulnerability Analysis

Elgg accepts avatar image uploads and resizes them server-side using either the GD library or Imagick. Before version 7.0.0, the upload handler validated file type and file size but did not enforce constraints on pixel dimensions or total resolution. When an image is decoded for resizing, PHP allocates memory proportional to width × height × channels, not the compressed file size on disk.

An attacker can craft a small compressed image, for example a highly compressed PNG, with declared dimensions in the tens of thousands of pixels. Decoding this image consumes hundreds of megabytes to several gigabytes of RAM. Repeated uploads exhaust the PHP process memory limit and can destabilize the host, producing a denial-of-service condition.

Root Cause

The root cause is missing input validation on image dimensions before invoking the resize routine. The Elgg\Config class did not expose configurable ceilings for source image width, height, or total resolution. As a result, the image processor accepted any dimensions the decoder could parse, allowing unbounded memory allocation during resize operations.

Attack Vector

Exploitation requires an authenticated account on the target Elgg site. The attacker uploads a compressed image file with oversized declared dimensions through the avatar upload endpoint. The server invokes the image processor, which allocates memory proportional to the raw pixel count and triggers an OOM error. No user interaction beyond the attacker's own session is required.

php

// Security patch in elgg-config/settings.example.php
// Source: https://github.com/Elgg/Elgg/commit/ab91d59dc2caaa3fdbfe7e9b916fc0cc7e6b323a

$CONFIG->allow_phpinfo = false;

/**
 * Configure image settings
 *
 * The 'image_processor' setting can be used to select a different image processor.
 * By default, the GD library is used.
 * Currently only 'imagick' is supported as a different configuration.
 *
 * In order to help prevent OOM issues with image resizing limitations can be set
 * on the source images
 *
 * @global int $CONFIG->image_resize_max_height     Max height (default: 10000 px)
 * @global int $CONFIG->image_resize_max_resolution Max resolution (default: 16777216 (16MP))
 * @global int $CONFIG->image_resize_max_width      Max width (default: 10000 px)
 */
//$CONFIG->image_processor = 'imagick';
//$CONFIG->image_resize_max_height = 10000;
//$CONFIG->image_resize_max_resolution = 16777216; // 16MP
//$CONFIG->image_resize_max_width = 10000;

Source: Elgg GitHub Commit ab91d59

Detection Methods for CVE-2026-65650

Indicators of Compromise

PHP error log entries containing Allowed memory size of X bytes exhausted correlated with avatar or icon upload endpoints
HTTP 500 responses from /action/avatar/upload or equivalent icon upload routes shortly after authenticated POST requests
Web server worker processes terminated by the OOM killer during image processing
Multiple large-dimension image uploads originating from a single authenticated session or IP address

Detection Strategies

Inspect image uploads in transit and log declared image dimensions from EXIF or file headers, alerting on values above expected avatar sizes
Correlate PHP fatal errors with the requesting user ID and upload endpoint to identify targeted abuse
Monitor for a sudden increase in php-fpm or Apache worker restarts on Elgg hosts

Monitoring Recommendations

Track memory consumption of PHP worker processes and alert on sustained spikes above baseline
Enable web application firewall (WAF) rules that inspect uploaded image metadata for oversized dimensions
Retain and review authentication logs to associate suspicious upload activity with specific accounts

How to Mitigate CVE-2026-65650

Immediate Actions Required

Upgrade Elgg to version 7.0.0 or later, which introduces image_resize_max_width, image_resize_max_height, and image_resize_max_resolution limits
For installations that cannot upgrade immediately, place a WAF or reverse proxy rule to reject image uploads exceeding a defined byte size threshold
Restrict avatar upload permissions to trusted user groups until patching is complete
Review recent server logs for OOM events tied to icon or avatar endpoints and revoke sessions of abusive accounts

Patch Information

The fix is included in Elgg 7.0.0. Review the GitHub commit ab91d59, the 7.0.0-rc.1 to 7.0.0 comparison, and the Pull Request 15041 discussion for implementation details. The patch adds three new configuration properties to Elgg\Config and enforces dimension checks before invoking the resize routine.

Workarounds

Lower the PHP memory_limit for the web-facing worker pool to fail fast rather than exhaust host memory
Enforce a strict client_max_body_size (nginx) or LimitRequestBody (Apache) at the reverse proxy to reduce accepted upload sizes
Use a pre-processing service or WAF to reject images whose declared width or height exceeds 10000 pixels
Disable avatar uploads temporarily by removing the corresponding action route until the patch is applied

bash

# Configuration example: set explicit image resize limits in Elgg 7.0.0+
# File: elgg-config/settings.php

$CONFIG->image_processor = 'imagick';
$CONFIG->image_resize_max_width  = 10000;   // pixels
$CONFIG->image_resize_max_height = 10000;   // pixels
$CONFIG->image_resize_max_resolution = 16777216; // 16 megapixels

# Reverse proxy hardening (nginx)
# /etc/nginx/conf.d/elgg.conf
client_max_body_size 5m;