Vulnerability feed

Executive summary

The e-SIC Livre (esiclivre) application, in version v0.2.2 and earlier, has a CAPTCHA component that can be made to use excessive server resources. An unauthenticated remote attacker could cause slowdowns, errors, or denial of service. The advisory does not state a severity score, and it says no upstream fix was available when the CVE was assigned, so it recommends applying local input validation and resource limits until a fix is released.

Technical summary

This is an uncontrolled resource consumption flaw (CWE class not stated) in restrito/inc/captcha.php. The GET parameters l, a, tf, and ql set CAPTCHA width, height, font size, and character count, and they are passed to GD image creation and text rendering without upper bounds. The endpoint is remotely reachable with no authentication, and the advisory says exhaustion can cause memory and CPU spikes, timeouts, and HTTP 5xx responses. Affected versions are v0.2.2 and earlier, up to and including commit 0a72b4c9ab89244ec3bd3d7fa0b765850cc9afd7; no fixed version is stated because no upstream fix was available. The advisory recommends integer conversion, min and max bounds, fixed dimensions, character limits, PHP memory and time limits, rate limiting, and freeing image resources. No detection guidance or CVSS score is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/brynax/CVE-2026-50787

Score

No CVSS score published.

Affects

e-SIC Livree-SIC Livre esiclivre