A critical vulnerability in the Turms AI-Serving module allows unauthenticated attackers to trigger a service crash through memory exhaustion via maliciously crafted image files.

The vulnerability exists within the ExtendedOpenCVImage class, which fails to validate image dimensions or pixel counts before processing. An unauthenticated attacker can upload a small, specially crafted image that expands to consume excessive memory upon decompression, leading to an OutOfMemoryError.

The exploitation of this vulnerability results in a denial of service, rendering the affected AI-Serving module unavailable to legitimate users. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to operational continuity, potentially causing system-wide instability or downtime for services reliant on the Turms AI infrastructure.

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the OCR service to trusted networks only and implement strict file size and type validation at the application firewall or ingestion layer.

Proactive Monitoring: Monitor system memory usage and application logs for frequent OutOfMemoryError exceptions or sudden spikes in resource consumption that may indicate an ongoing attack.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway configured to inspect and limit the complexity of uploaded image files before they reach the backend processing module.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security report linked by the CVE record.

Given the ease of exploitation and the potential for service disruption, organizations should treat this vulnerability with high priority. While a formal vendor patch is pending, applying network-level restrictions and input validation is essential to mitigate the risk of service degradation.