CVE Feed

    Dashboard / CVE / CVE-2025-66909

    CVE-2025-66909

    Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCVImage class in ai/djl/opencv/ExtendedOpenCVImage.java loads images using OpenCV's imread() function without validating dimensions or pixel count before decompression. An attacker can upload a specially crafted compressed image file (e.g., PNG) that is small when compressed but expands to gigabytes of memory when loaded. This causes immediate memory exhaustion, OutOfMemoryError, and service crash. No authentication is required if the OCR service is publicly accessible. Multiple requests can completely deny service availability.

    Published:Dec 19, 2025
    Last Modified:Jan 2, 2026
    EPS:Dec 19, 2025
    EPSS Score:0.00095
    CVSS Score:7.5

    Affected Products

    Vendor
    Turms
    Product
    Ai Serving
    Vendor
    Turms-im
    Product
    Turms

    Exploits

    https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66909_report.mdhttps://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66909_report.md

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High