imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy

Description

References

• imgproxy/imgproxy security advisory · ADVISORY
• imgproxy/imgproxy commit 39fd9e8 · FIX
• imgproxy/imgproxy#1726 · FIX
• imgproxy/imgproxy release v4.0.17 · WEB

Altre vulnerabilità di github.com/imgproxy/imgproxy

• GO-2026-6898imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in gith…
• GO-2026-6897imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgpro…
• GHSA-hff9-5pqw-6w9fCRITICO 9.8imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
• CVE-2025-24354MEDIO 5.3imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LO…
• CVE-2023-30019MEDIO 5.3imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.