CVE-2025-66909
📋 TL;DR
This vulnerability allows unauthenticated attackers to cause denial of service by uploading specially crafted image files that trigger memory exhaustion when decompressed. The Turms AI-Serving module's image processing component fails to validate image dimensions before loading, enabling decompression bomb attacks. Any system running vulnerable versions with the OCR service exposed is affected.
💻 Affected Systems
- Turms AI-Serving module
📦 What is this software?
Turms by Turms Im
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability through memory exhaustion crashes, potentially affecting all connected services in the same environment.
Likely Case
Service crashes and restarts causing intermittent availability issues, degraded performance for legitimate users.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Simple file upload attack with readily available decompression bomb creation tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not yet released
Vendor Advisory: https://github.com/turms-im/turms
Restart Required: Yes
Instructions:
1. Monitor Turms GitHub repository for security updates. 2. Apply patch when available. 3. Restart affected services.
🔧 Temporary Workarounds
Implement image validation middleware
allAdd pre-processing layer to validate image dimensions and file size before passing to vulnerable component.
Configure JVM memory limits
allSet strict memory limits to contain damage from memory exhaustion attacks.
java -Xmx512m -Xms256m ...
🧯 If You Can't Patch
- Restrict image upload functionality to authenticated users only
- Implement rate limiting and file size restrictions on upload endpoints
🔍 How to Verify
Check if Vulnerable:
Check if running Turms AI-Serving v0.10.0-SNAPSHOT or earlier with image processing enabled.Check Version:
Check application version in configuration or via API endpoints if available.Verify Fix Applied:
Test with known decompression bomb images after applying fixes to ensure proper validation occurs.📡 Detection & Monitoring
Log Indicators:
- OutOfMemoryError exceptions
- Repeated service crashes
- Unusually large memory allocation patterns
Network Indicators:
- Multiple image upload requests from single source
- Small compressed files followed by memory spikes
SIEM Query:
source="application.logs" AND ("OutOfMemoryError" OR "java.lang.OutOfMemoryError") AND process="turms-ai-serving"🔗 References
- https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66909_report.md
- https://github.com/turms-im/turms
- https://github.com/turms-im/turms/blob/develop/turms-ai-serving/src/main/java/ai/djl/opencv/ExtendedOpenCVImage.java#L37
- https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66909_report.md
