Executive brief
Cloudreve, a self-hosted file management and sharing system, is vulnerable to a denial-of-service attack. An authenticated user can upload a specially crafted, small image file (a "pixel bomb") that appears to have massive dimensions. When the system attempts to process this image to create a thumbnail or avatar, it tries to allocate an enormous amount of memory, causing the entire application to crash and become unavailable to all users.
Technical details
Cloudreve's built-in image processor (prior to version 4.17.0) fails to validate decoded pixel dimensions for PNG, JPEG, and GIF files, relying only on compressed file size limits. The vulnerability exists in the thumbnail generation worker and the avatar upload handler (`PUT /api/v4/user/setting/avatar`). When Go's standard library decoders (`image/png`, `image/jpeg`, `image/gif`) encounter a "pixel bomb"—a small file declaring massive dimensions in its header—they attempt an unbounded memory allocation for the pixel buffer. This results in a fatal Go runtime error or a kernel OOM-kill that cannot be caught by standard recovery middleware, leading to a complete process crash. The issue is fixed in version 4.17.0 by implementing maximum pixel dimension constraints.
Affected products
- Cloudreve Cloudreve < 4.17.0
Timeline
- 2026-06-26: patched: Version 4.17.0 released with security fixes.
- 2026-07-23: advisory: GitHub Security Advisory GHSA-g9j2-8w95-3vwv published.
- 2026-07-31: disclosed: CVE-2026-55497 published to the NVD.