{"affected":[{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"image-size","product":"image-size","source":"CNA: VulnCheck","vendor":"image-size","versions":[{"lessThanOrEqual":"1.2.1","status":"affected","version":"1.1.0","versionType":"semver"},{"lessThanOrEqual":"2.0.2","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"discovery/discovery-ui-rhel9","product":"Red Hat Discovery 2","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782756541","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhtas/rekor-search-ui-rhel9","product":"Red Hat Trusted Artifact Signer 1.4","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783327185","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gatekeeper/gatekeeper-rhel9","product":"Gatekeeper 3","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rh-podman-desktop.git","product":"Red Hat Build of Podman Desktop","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"subscription-manager","product":"Red Hat Enterprise Linux 7","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"grafana","product":"Red Hat Enterprise Linux 8","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"grafana-pcp","product":"Red Hat Enterprise Linux 8","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"subscription-manager","product":"Red Hat Enterprise Linux 8","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"image-size","product":"Red Hat Fuse 7","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"image-size","product":"Red Hat JBoss Enterprise Application Platform 7","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"image-size","product":"Red Hat JBoss Enterprise Application Platform 8","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"image-size","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/code-rhel9","product":"Red Hat OpenShift Dev Spaces","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"satellite/iop-vulnerability-frontend-rhel9","product":"Red Hat Satellite 6","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2025-71319","cwes":["CWE-835"],"description":"image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.","epss":{"date":"2026-11-08","percentile":0.5447,"score":0.00729},"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities"}],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"ADP: redhat-SADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794146422491,"publishedAt":1781035036125,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-jxl-heif-parser"},{"source":"ADP: redhat-SADP","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-71319"},{"source":"ADP: redhat-SADP","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487296"},{"source":"ADP: redhat-SADP","tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71319.json"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:33313"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:37272"}],"remediation":[{"kind":"fix","source":"ADP: redhat-SADP","text":"RHSA-2026:33313: Red Hat Discovery 2\n\nRHSA-2026:37272: Red Hat Trusted Artifact Signer 1.4"},{"kind":"workaround","source":"ADP: redhat-SADP","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439"}],"revision":"6cfc8041de469576bef6aaee44cc7cf4722ae1d85878794885999fb69daeb1ea","sources":[{"modifiedAt":1794146422491,"name":"CNA: VulnCheck","retrievedAt":1794146974681,"url":"https://www.cve.org/CVERecord?id=CVE-2025-71319"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150588551,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-71319"}],"ssvc":{"assessedAt":1781105314029,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser","updatedAt":1794150588551}