How Cloudflare Images addressed the aCropalypse vulnerability

What this post added

Cloudflare Images and Image Resizing products now include specific logic to detect and prevent the re-encoding of images containing trailers, which can expose sensitive data due to vulnerabilities like aCropalypse. This is achieved by parsing JPEG and PNG file structures to identify data beyond the end-of-image marker. For JPEGs, this involves using libjpeg-turbo to check for remaining bytes after consuming the EOI marker. For PNGs, a custom parser iterates through chunks until the IEND chunk is found, checking for any remaining data. This ensures that affected images are always re-encoded, thereby mitigating the vulnerability without requiring changes to customer origin images or introducing latency.