Hub/Blog/Decompression Bombs & DoS
Decompression Bombs & DoSRutvij Khatri•7 min read•Published 2026-10-14

Image Decompression Bombs: Preventing Pixel Flood DoS Attacks

How tiny 50KB image files expand to 6+ Gigabytes of RAM during decompression and how infrastructure teams prevent OOM server crashes.

The Compression Expansion Ratio

Modern compression formats compress solid color or repetitive pattern blocks with extreme efficiency. A JPEG with dimensions of 40,000 x 40,000 pixels can weigh just 50KB on disk.

However, when backend libraries (ImageMagick, Sharp, PIL) decompress the file, they allocate a raw RGBA memory buffer: 40,000 * 40,000 * 4 bytes = 6.4 GB RAM.

Key Investigative Takeaway

Always parse image dimensions from headers before passing buffers to image decoders, and enforce hard limits (e.g. max 25 Megapixels).

#image decompression bomb#pixel flood dos attack#imagemagick oom crash#prevent image dos
RK
Rutvij KhatriSecurity Analyst

Security Analyst and Aspiring Security Engineer passionate about digital image forensics, OSINT research, CTF steganography challenges, and client-side application security.

Related Guides in Decompression Bombs & DoS