MEDIUMCVSS 6.5

CVE-2026-55497

CVE-2026-55497 updated by NVD

Published: 2026-07-24
Modified: 2026-09-10
Sources: github-advisory, nvd

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, or GIF that triggers an unbounded allocation and terminates the Cloudreve process through fatal out-of-memory behavior. This issue is fixed in version 4.17.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/cloudreve/Cloudreve/v3	—	—
Go	github.com/cloudreve/Cloudreve/v4	—	4.0.0-20260613024411-3607f79bb44c

Remediation: No patched version is listed by GitHub.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55497

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.