CVE-2026-55595

Summary

ImageMagick: Infinite Loop in connected-components when providing invalid arguments

Severity

medium

CVSS

4.7

EPSS

0.1% (p0)

CWE

CWE-400, CWE-835

Also known as

GHSA-qhmf-7fc4-8q3h#Magick.NET-Q16-AnyCPU

Published

2026-07-24

Updated

2026-07-24

Advisory details

When providing invalid arguments to the connected-components option an infinite loop will occur.

References

• https://github.com/advisories/GHSA-qhmf-7fc4-8q3h
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qhmf-7fc4-8q3h
• https://nvd.nist.gov/vuln/detail/CVE-2026-55595
• https://github.com/dlemstra/Magick.NET/releases/tag/14.15.0

Related advisories

• GHSA-6w6g-hm98-mhgm — high · crates.io/hickory-resolver
• CVE-2026-101895 — high · npm/@angular/platform-server
• CVE-2026-81876 — high · Maven/ca.uhn.hapi.fhir:org.hl7.fhir.r5
• CVE-2026-68523 — high · crates.io/fulgur
• CVE-2026-63202 — high · Maven/io.netty.incubator:netty-incubator-codec-bhttp
• CVE-2026-63124 — high · Maven/io.netty.incubator:netty-incubator-codec-bhttp
• CVE-2026-115774 — medium · PyPI/Twisted
• CVE-2026-107391 — medium · npm/music-metadata

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity