CVE-2026-70377: imagecli DOS Vulnerability

CVE-2026-70377 Overview

CVE-2026-70377 is an uncontrolled memory allocation vulnerability in imagecli, a Rust command-line image processing tool. The flaw resides in the scale <ratio> pipeline operation implemented by Scale::apply() in src/image_ops.rs. The function computes output width and height as (dimension as f32 * ratio) as u32 without validating an upper bound on the user-supplied ratio. A large ratio value forces imagecli to request hundreds of terabytes of memory, which aborts the process. Any application that embeds imagecli as a library and accepts user-controlled pipeline strings can be crashed remotely with a single request. The weakness is tracked under [CWE-789] (Memory Allocation with Excessive Size Value).

Critical Impact
Remote attackers can crash any service embedding imagecli by supplying a single malformed pipeline string containing an oversized scale ratio.

Affected Products

imagecli command-line tool
Applications embedding imagecli as a Rust library
Services exposing imagecli pipeline strings to untrusted input

Discovery Timeline

2026-08-05 - CVE-2026-70377 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70377

Vulnerability Analysis

The defect lives in the Scale::apply() function within src/image_ops.rs. imagecli parses the CLI-supplied ratio using nom::number::complete::float, which accepts any valid IEEE-754 float without enforcing a numeric range. The parsed ratio is then multiplied against the input image dimensions and cast to u32 to determine the output buffer size.

Because no bounds check exists, a ratio such as 100000 on a modestly sized image produces output dimensions in the millions of pixels per axis. The subsequent buffer allocation request reaches into the hundreds of terabytes. The Rust allocator returns an allocation failure, and the process aborts. The result is a reliable denial-of-service condition against any consumer of the pipeline API.

Root Cause

The root cause is missing input validation on the numeric ratio parameter. The parser accepts any well-formed float, and the computation path does not check either the ratio itself or the resulting product against a sane maximum. This matches the pattern described by [CWE-789], where an attacker-controlled value drives an allocation size the process cannot satisfy.

Attack Vector

Exploitation requires only that an attacker supply a pipeline string containing scale <ratio> with a sufficiently large ratio. When imagecli is embedded in a network-facing application, such as a web service that transforms uploaded images according to a client-provided pipeline, the request path is fully remote, unauthenticated, and requires no user interaction. A single request terminates the host process.

Refer to the GitHub Issue Discussion for the maintainer thread describing the abort behavior and reproduction steps.

Detection Methods for CVE-2026-70377

Indicators of Compromise

Repeated process aborts or crashes in services that invoke imagecli pipelines
Allocation failure messages such as memory allocation of N bytes failed in service logs
HTTP requests containing pipeline strings with large scale ratios, for example scale 100000
Unexpected restart loops in container workloads embedding imagecli

Detection Strategies

Inspect request payloads and CLI arguments for scale tokens followed by unusually large float values before they reach imagecli
Correlate service crash telemetry with the input payload that preceded the abort
Instrument the imagecli invocation wrapper to log the parsed ratio and reject values outside an operational range

Monitoring Recommendations

Alert on process aborts and out-of-memory events on hosts running imagecli-embedded services
Track HTTP 5xx spikes on endpoints that accept image transformation pipelines
Feed application and host telemetry into a centralized data lake to correlate crashes with request payloads

How to Mitigate CVE-2026-70377

Immediate Actions Required

Reject or sanitize any user-controlled scale ratio before invoking imagecli, capping the value at an application-defined maximum
Isolate imagecli invocations in a sandboxed subprocess with strict memory limits so a single request cannot terminate the parent service
Enumerate all internal services that embed imagecli as a library and add input validation at the request boundary

Patch Information

No fixed version is listed in the NVD entry at time of publication. Track the upstream GitHub Issue Discussion for remediation progress and apply an upstream fix once released.

Workarounds

Validate pipeline strings against an allowlist of operations and numeric ranges before passing them to imagecli
Run imagecli under a resource-limited process (for example, ulimit -v or a cgroup memory cap) so allocation failures do not affect co-tenant workloads
Disable exposure of the raw pipeline string to untrusted callers and offer a fixed set of transformation presets instead

bash

# Configuration example: enforce a memory ceiling on the imagecli subprocess
ulimit -v 1048576   # cap virtual memory at 1 GiB (KiB units)
imagecli --pipeline "scale $SAFE_RATIO" -i input.png -o output.png