About the outages on the 23rd, 24th and 26th of April
On the 23rd, 24th and 26th of April 2026 Pixeldrain experienced some downtime.
I assume this was some kind of denial of service attack, though it could also have been an accident, I can't really be sure. Nobody has come forward to claim credit. I will still refer to the person behind this as the "attacker", as is usual in security write-ups.
The site was not compromised and no customer data is at risk. Someone just found a way to temporarily take the servers offline.
Technical details
Pixeldrain generates thumbnail files for images and videos on the platform. These thumbnail images are shown in albums and in embeds on social media platforms and such.
To generate a thumbnail image, a server needs to first decode the source file in order to scale it down and crop it. Before this happens the server first checks if the file is really an image, then it checks the size of the file. Images larger than 64 MiB do not get a thumbnail image because it would take too much memory to decode. But that 64 MiB limit is just for the encoded image file, not for the decoded state. To generate the thumbnail the image needs to be decoded, which loads all the pixels into RAM in a bitmap format. This decoded format can be much larger than the source image file because it uses no compression.
Someone uploaded a PNG image which was well below 64 MiB in its compressed state, but would take terabytes of RAM to decode. Probably by having an enormous resolution, like a million by a million pixels. An image of that size would be 3 TB in the bitmap format. This file is basically the PNG equivalent of a Zip Bomb. When Pixeldrain tried to generate a thumbnail file for this image it would run out of memory and crash, taking the site down temporarily. The service manager systemd would restart it after the crash, but the attacker could just request the thumbnail again and it would crash again.
Mitigation
When this happened I was on vacation (as is usual when the site is attacked...), and I didn't have the ability to patch it from my laptop due to a limited network connection and lack of time. When I eventually discovered what the issue was I managed to disable the generation of PNG images so the servers would stabilize. Only, two days later (on the 26th) the attacker uploaded a JPEG image which had the same effect.
At this time I was back at home and able to implement a real fix. I am now using the image.DecodeConfig function in Go to check the image's resolution before we generate a thumbnail. If the image is larger than 8192x8192 (67.1 MP) we will not generate a thumbnail for it anymore.
Notes
I also want to say something about my security approach. Pixeldrain's codebase was written over a period of more than 10 years by one person: me. I don't have time to do deep security analysis. I could probably have anticipated this scenario when I was building the thumbnail system, but that was a long time ago and I was less of a programmer back then. Either I didn't think of it, or I expected the image decoding library to have protections against it.
There could be more issues like this in the codebase. The web is becoming more hostile by the day (partially fueled by the adoption of LLMs, but also international conflicts). It's not inconceivable that another situation like this will happen again later. All I'm saying is: don't expect Pixeldrain to function like a big tech product. Downtime will happen and I will do my best to fix it in time, but I'm just some guy who also has hobbies outside of programming and I might not always be there to fix it.
Anyway, hope you had a nice weekend. I just celebrated King's Day here in the Netherlands. It was a good time.
Greetings,
Wim.
Comments (28)
I too am having issues today
Hello, is there something wrong right now with Pixeldrain?? its down now for like a day or something
oh, didn't noticed, but thanks for the info!
Thanks for the info and for your work
Site is completely down for me, cannot load anything from multiple IPs. "Could not connect to the server."
There is a problem with the database, it is currently unstable. You might see the site go down sometimes until I have found a solution
something going on again as i am getting alot of 404 for files that have recently been uploaded
There is a problem with the database, it is currently unstable. You might see the site go down sometimes until I have found a solution
i got The provided API key is invalid, has been revoked or has expired i cant login .
Hii, Fornax, please tell me that in the free plan, I uploaded the video and shared the link and all the users who download have a limit of downloading 6 GB file per day, similarly if I purchase a plan of 5 dollars and upload the video and share the link, then does every user have a monthly download limit of 4 TB or not, please tell me brother, it is very confusing please reply don't ignore please 🥺
Hii, Fornax, please tell me that in the free plan, I uploaded the video and shared the link and all the users who download have a limit of downloading 6 GB file per day, similarly if I purchase a plan of 5 dollars and upload the video and share the link, then does every user have a monthly download limit of 4 TB or not, please tell me brother, it is very confusing please tell me
There is two novel I would like for APK. 1 Vanimate by Vanimate.com. 2 Regret Island
how i get the 120 gb
Hii, Fornax, please tell me that in the free plan, I uploaded the video and shared the link and all the users who download have a limit of downloading 6 GB file per day, similarly if I purchase a plan of 5 dollars and upload the video and share the link, then does every user have a monthly download limit of 4 TB or not, please tell me brother, it is very confusing please
Thanks for updating everyone. I too didn't notice the downtime, so pretty transparent at least from my end in the states. In any case, hope you enjoyed King's Day. :)
thank you 🙏🏾
Also speaking of hostile internet... I don't know if your service is affected but look into this and look out for the possibility of attack from this vector... https://copy.fail/
This is a local root esculation bug, any uncontrolled code can be used to gain local root on any Linux distro.
I appreciate the work and transparency. I would rather support a one man party doing good stuff then a huge tech company with Alterior, hidden or scummy motives. At least nothing is lost, that's the important part right?
The transparency is pretty cool. I didn't even notice the outage, and this was an interesting read.
Transparency. No excuses. Honesty. You continue to have my respect sir. I joined pixeldrain for one reason. I have stayed and will continue to stay for another. I have learned a valuable lesson in how to be up front, honest, and factual.
Thanks for the info, I thought I was downloading to much at once and simply slowed down.
Thank you so much! The work you do here is absolutely priceless and something that we don't take for granted. Some down time now and again is such a tiny price to pay given the service you provide here all year round. Wishing you the best🙏
Thanks for the professional writeup and explanation. I've seen much bigger outfits do much less for much worse.
Hey Wim, Thanks for the transparency! I was confused myself why pixeldrain was slow 😂. Ty for the update, keep up the good work!
I know this isn't what you meant but the way you phrased "on vacation (as usual)" made it sound like you were taking something like 300 days a year vacation :P If you need a butler give me a shout, that's my sort of work/life balance!
I understood it as "like always these things happen when I'm on vacation" (bad things happen always at the most inopportune time) and I'm pretty sure that's what he meant.
W