Description
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| imgproxy | imgproxy | 3.3.0 – < 4.0.16 | 4.0.16 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/imgproxy/imgproxy | all versions | — | GO-2026-6898 |
| Go | github.com/imgproxy/imgproxy/v2 | all versions | — | GO-2026-6898 |
| Go | github.com/imgproxy/imgproxy/v3 | >= 3.3.0, < 4.0.16 | 4.0.16 | GHSA-mmq5-xm89-9pfg |
| Go | github.com/imgproxy/imgproxy/v3 | >= 3.3.0 | — | GO-2026-6898 |
| Go | github.com/imgproxy/imgproxy/v4 | < 4.0.16 | 4.0.16 | GO-2026-6898 |
References
- GitHub Security Advisory (GHSA-mmq5-xm89-9pfg) vendor-advisory
- VulnCheck Advisory: imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader third-party-advisory