CVE-2021-38623
Improper Resource Shutdown or Release in TYPO3 extension
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
- Record
CVE-2021-38623- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-404
- Updated
- 2026-11-02
CVE List No score
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
- Record
CVE-2021-38623- Updated
- 2026-11-02
EUVDEUVD-2021-1527 No score
The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.
- Record
EUVD-2021-1527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-34jq-548x-m2x9
Improper Resource Shutdown or Release in TYPO3 extension
Wrong usage of the TYPO3 FAL API results in copies of processed files being saved to the /var/transient/ folder of a TYPO3 website on every frontend request. This can result in Denial of Service, since the webspace may be filled up with image files simply by crafting a large amount of requests to the website.
- Record
GHSA-34jq-548x-m2x9- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C - Weakness
- CWE-404
- Updated
- 2026-11-02
OSVGHSA-34jq-548x-m2x9
Improper Resource Shutdown or Release in TYPO3 extension
Wrong usage of the TYPO3 FAL API results in copies of processed files being saved to the /var/transient/ folder of a TYPO3 website on every frontend request. This can result in Denial of Service, since the webspace may be filled up with image files simply by crafting a large amount of requests to the website.
- Record
GHSA-34jq-548x-m2x9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C - Weakness
- CWE-404
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webcoast/deferred-image-processingPackagist |
before 1.0.2 | 1.0.2 |
webcoast/deferred-image-processingPackagist |
before 1.0.2, plus listed versions 1.0.01.0.1 |
1.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38623 is a high vulnerability (CVSS 7.5) in Deferred Image Processing Project Image Processing, published August 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in webcoast/deferred-image-processing 1.0.2.