imagecli's `scale <ratio>` pipeline operation (Scale::apply() in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upp…

CVE-2026-70377 affects the imagecli Rust library's `scale <ratio>` pipeline operation in Scale::apply() within src/image_ops.rs. The vulnerability stems from the absence of upper-bound validation on the CLI-supplied ratio parameter, which is parsed using nom::number::complete::float without any range check. An attacker supplying an extremely large ratio (e.g., 100000) causes the application to attempt an allocation of hundreds of terabytes of memory, resulting in process abortion. Any application embedding imagecli as a library that accepts user-controlled pipeline strings is remotely crashable with a single malicious request. This constitutes a Denial of Service (DoS) vulnerability exploitable by unauthenticated remote users. The root cause is a missing input validation guard before the arithmetic computation (dimension as f32 * ratio) as u32. A fix would require enforcing a maximum allowable ratio value before processing the scale operation.