imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgproxy/imgproxy

Description

References

• imgproxy/imgproxy security advisory · ADVISORY
• imgproxy/imgproxy commit a821b6a · FIX
• imgproxy/imgproxy release v4.0.16 · WEB

More vulnerabilities in github.com/imgproxy/imgproxy

• GO-2026-6898imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in gith…
• GO-2026-6895imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github…
• GHSA-hff9-5pqw-6w9fCRITICAL 9.8imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
• CVE-2025-24354MEDIUM 5.3imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LO…
• CVE-2023-30019MEDIUM 5.3imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.