CVE-2026-55497: Cloudreve denial of service via image decompression pixel bomb

CVE-2026-55497 · Severity: medium · CVSS 6.5 · Published 2026-07-31

Cloudreve, a self-hosted file management and sharing system, is vulnerable to a denial-of-service attack. An authenticated user can upload a specially crafted, small image file (a "pixel bomb") that appears to have massive dimensions. When the system attempts to process this image to create a thumbnail or avatar, it tries to allocate an enormous amount of memory, causing the entire application to crash and become unavailable to all users.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is CVE-2026-55497 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55497 being exploited in the wild.
How severe is CVE-2026-55497?
Medium severity, with a CVSS score of 6.5, published 31 July 2026.
Which products and versions are affected?
Cloudreve < 4.17.0, v3 <= 3.0.0-20250225100611-da4e44b77af4, v4 < 4.0.0-20260613024411-3607f79bb44c; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260613024411-3607f79bb44c, SEMVER:introduced=0,fixed=4.0.0-20260613024411-3607f79bb44c.
Is there a fix for CVE-2026-55497?
Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613024411-3607f79bb44c or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55497 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55497?
Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613024411-3607f79bb44c or later
    go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260613024411-3607f79bb44c

Technical details

Cloudreve's built-in image processor (prior to version 4.17.0) fails to validate decoded pixel dimensions for PNG, JPEG, and GIF files, relying only on compressed file size limits. The vulnerability exists in the thumbnail generation worker and the avatar upload handler (`PUT /api/v4/user/setting/avatar`). When Go's standard library decoders (`image/png`, `image/jpeg`, `image/gif`) encounter a "pixel bomb"—a small file declaring massive dimensions in its header—they attempt an unbounded memory allocation for the pixel buffer. This results in a fatal Go runtime error or a kernel OOM-kill that cannot be caught by standard recovery middleware, leading to a complete process crash. The issue is fixed in version 4.17.0 by implementing maximum pixel dimension constraints.

Affected products

  • Cloudreve Cloudreve < 4.17.0

Identifiers

  • CVE-2026-55497
  • GHSA-g9j2-8w95-3vwv
  • GO-2026-6100

Timeline

  • 2026-06-26: patched: Version 4.17.0 released with security fixes.
  • 2026-07-23: advisory: GitHub Security Advisory GHSA-g9j2-8w95-3vwv published.
  • 2026-07-31: disclosed: CVE-2026-55497 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.