Improper Resource Shutdown or Release in TYPO3 extension

HOCH 7.5CVE-2021-38623 · GHSA-34jq-548x-m2x9 · Published 13/08/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-38623 ist eine Schwachstelle (HOCH (CVSS 7.5)) in webcoast/deferred-image-processing, deferred image processing (deferred image processing project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.96%, höher als bei 61.8% aller Schwachstellen.
Abhilfe: auf 1.0.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
webcoast/deferred-image-processing Packagist	`< 1.0.2`	`1.0.2`
deferred image processing deferred_image_processing_project	`< 1.0.2`	`1.0.2`

Description

Wrong usage of the TYPO3 FAL API results in copies of processed files being saved to the /var/transient/ folder of a TYPO3 website on every frontend request. This can result in Denial of Service, since the webspace may be filled up with image files simply by crafting a large amount of requests to the website.

NVD description

The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.

References

nvd.nist.gov/vuln/detail/CVE-2021-38623 · ADVISORY
webcoast-dk/deferred-image-processing · PACKAGE
typo3.org/security/advisory/typo3-ext-sa-2021-009 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free