brynax/cve-2026-50787Security advisory detailing CVE-2026-50787, an uncontrolled resource consumption vulnerability in e-SIC Livre CAPTCHA generation, enabling remote denial of service via oversized parameters.
A resource consumption vulnerability exists in the CAPTCHA generation component of e-SIC Livre (esiclivre).
The vulnerable endpoint accepts user-controlled parameters that define CAPTCHA image dimensions, font size, and the number of characters to render. These values are used without appropriate bounds checking.
An unauthenticated remote attacker can supply excessively large values, causing the application to consume significant memory and CPU resources during image creation and text rendering. This may result in application timeouts, HTTP 5xx responses, worker exhaustion, or denial of service.
0a72b4c9ab89244ec3bd3d7fa0b765850cc9afd7restrito/inc/captcha.phpThe endpoint accepts the following GET parameters:
l - image widtha - image heighttf - font sizeql - number of CAPTCHA charactersThese parameters are obtained directly from user input and used in image-processing operations without appropriate upper bounds.
The vulnerable code reads values directly from $_GET:
$largura = $_GET["l"];
$altura = $_GET["a"];
$tamanho_fonte = $_GET["tf"];
$quantidade_letras = $_GET["ql"];
captcha($largura,$altura,$tamanho_fonte,$quantidade_letras);
The supplied width and height are subsequently passed to the GD image creation function:
$imagem = imagecreate($largura,$altura);
The user-controlled ql value also determines the number of iterations performed when rendering CAPTCHA characters:
for($i = 1; $i <= $quantidade_letras; $i++){
imagettftext(
$imagem,
$tamanho_fonte,
rand(-25,25),
($tamanho_fonte*$i),
($tamanho_fonte + 10),
$branco,
$fonte,
substr($palavra,($i-1),1)
);
}
Because these values are not constrained to reasonable limits, specially crafted requests can force the application to perform excessive image allocation and text-rendering operations.
The vulnerable CAPTCHA endpoint is remotely accessible.
An attacker can submit requests containing abnormally large values for the image dimensions, font size, or character count. The server then attempts to process those values using PHP GD operations.
This can lead to:
No authentication is required to reach the vulnerable functionality.
Successful exploitation can result in Denial of Service (DoS) through uncontrolled resource consumption.
The impact depends on the PHP configuration, available system resources, web server configuration, and number of concurrent requests.
The vulnerability is caused by insufficient validation and lack of upper bounds on user-controlled parameters before they are passed to resource-intensive GD image operations.
The application should strictly validate all CAPTCHA generation parameters before processing them.
Recommended measures include:
Example defensive limits could include reasonable maximum values for width, height, font size, and CAPTCHA length according to the application's intended interface.
No upstream fix was available at the time the CVE was requested and assigned.
Users deploying affected versions should apply local validation and resource limits until an upstream fix becomes available.
Discovered and reported by Bryan Romero https://github.com/brynax
This advisory documents the vulnerability, its technical root cause, and recommended mitigations for defensive and remediation purposes. It intentionally omits automated denial-of-service tooling, high-volume exploitation methods, and operational instructions that could facilitate abuse.