[BUG] getimagesize() on missing image causes LSAPI deadlock and full site outage (PHP 8.3.24, LSCache 7.4)

[grn-dk]

Environment

PHP version: 8.3.24

LiteSpeed Cache for WordPress: 7.4

Web Server: OpenLiteSpeed (OLS)

We're experiencing critical issues where the site goes down due to LSAPI deadlocks caused by the LiteSpeed Cache plugin.

When the plugin attempts to call getimagesize() on a missing image (typically under /wp-content/uploads/), the following error appears repeatedly in the logs:

[STDERR] PHP Warning: getimagesize(https://example.com/wp-content/uploads/2021/10/example_file.png): Failed to open stream: HTTP request failed! in /folder/example.com/wp-content/plugins/litespeed-cache/src/media.cls.php on line 899

This is immediately followed by OpenLiteSpeed logs like:

No request delivery notification has been received from LSAPI application, possible dead lock

This stalls PHP workers, causes ExtConn timed out while processing messages, and ultimately results in the entire WordPress site becoming unresponsive.

Root Cause
It appears that getimagesize() is used without a prior check to confirm the existence or availability of the image URL. When the image is missing or the HTTP call fails, the process hangs and blocks the PHP worker without timing out gracefully.

Expected Behavior
The plugin should verify that the image exists before attempting to process or cache it. Failing that, it should handle the error gracefully without crashing the PHP worker or causing LSAPI deadlocks.

Suggested Fix
Add a check before getimagesize():

if (@get_headers($url)[0] !== 'HTTP/1.1 404 Not Found') {
    $info = getimagesize($url);
}

Or at least wrap the getimagesize() call in a suppression and error-handling block to prevent hanging on 404s.

[hi-hai]

Can you please make a test script to debug the issue?

<?php
$sizes = getimagesize("https://your404link");
var_dump($sizes);

See if it can cause the deadlock or not. Thanks.

[grn-dk]

Yes, you're correct — running getimagesize() on a single 404 URL does not cause a deadlock by itself. However, the issue emerges under concurrent load, which reflects real-world scenarios (e.g., crawlers, users, or cache warmers).

When I simulate concurrency (e.g., 500+ simultaneous requests calling getimagesize() on a missing image), the server becomes overwhelmed. This leads to LSAPI workers hanging, and eventually results in:

No request delivery notification has been received from LSAPI application, possible dead lock

ExtConn timed out while processing

The error logs fill with thousands of repeated getimagesize() warnings, all from the LiteSpeed Cache plugin attempting to process the same missing image.

Please see the attached anonymized log snippet that demonstrates this pattern.

test_error_log_snippet.log

I believe the root of the issue is that getimagesize() is being called without verifying whether the image URL is valid or accessible — and under high concurrency, this cascades into worker saturation and timeouts.

The issue is immediately resolved when litespeed-cache wordpress plugin is deactivated.

Thank you!