A memory leak vulnerability in Imager::File::JPEG enables unauthenticated attackers to trigger a denial-of-service, impacting system availability.

This issue (CWE-401) occurs due to the missing release of memory after its effective lifetime. An attacker can trigger this condition, leading to memory exhaustion and a denial-of-service (DoS) state.

Successful exploitation results in service instability or total application crashes, directly impacting system availability. Given the CVSS score of 7.5, the risk is elevated for environments that rely on this library for high-throughput image processing, potentially causing significant operational downtime.

Immediate Action: Upgrade to Imager::File::JPEG version 1.003 or later. If the bundled copy is in use, upgrade to Imager version 1.032 or later.

Proactive Monitoring: Monitor server memory consumption and application stability logs for frequent restarts or out-of-memory errors that may indicate an active DoS attempt.

Compensating Controls: Implement resource limits (such as container memory limits or request timeouts) to mitigate the impact of memory exhaustion attacks while planning the update.

Public Exploit Available: false

This vulnerability poses a clear risk to service availability. Organizations utilizing Imager::File::JPEG should prioritize the update to the patched versions provided by the vendor to prevent potential service disruptions caused by memory exhaustion.