imgproxy
Security incidents tagged imgproxy. Newest first.
1 imgproxy incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 7
- Longest quiet run: 7 days (Oct 31–Nov 6)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
imgproxy ICO loader: unauthenticated integer overflow may allow RCE, plus heap OOB and memory-exhaustion DoS (GHSA-hff9-5pqw-6w9f / 494m / mmq5)
imgproxy's ICO loader (vips/icoload.c) has three related flaws reachable with a crafted image. GHSA-hff9-5pqw-6w9f is a critical unauthenticated integer overflow: an attacker-controlled 32-bit data_size wraps when BMP_FILE_HEADER_LEN is added, so the process allocates a few bytes then writes far past the buffer — GitHub rates it CVSS 3.1 9.8 and says the heap overflow can cause denial of service or remote code execution. GHSA-mmq5-xm89-9pfg (high, CVSS 7.5) passes the same data_size to VIPS_MALLOC without a bound, so a tiny ICO can force a multi-gigabyte allocation. GHSA-494m-4556-wf5p (high, CVSS 7.5) reconstructs a BMP header from unvalidated fields and can write out of bounds, crashing the worker. Fixed in v4.0.16 (overflow + unbounded alloc) and v4.0.17 (OOB heap R/W). Also tracked as GO-2026-6897, GO-2026-6898 and GO-2026-6895.
imgproxySince Oct 30, 2026
