logo

Database

Out-of-bounds read In github.com/imgproxy/imgproxy

Description

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. OSV-GO-2026-68952. GHSA-494m-4556-wf5p3. GCVE-GHSA-494m-4556-wf5p4. GHSA-494m-4556-wf5p

References

1. https://github.com/imgproxy/imgproxy/security/advisories/GHSA-494m-4556-wf5p2. https://github.com/imgproxy/imgproxy/pull/17263. https://github.com/imgproxy/imgproxy/commit/39fd9e844a8a46084161502e993d5a3c16ccf28d4. https://github.com/imgproxy/imgproxy/releases/tag/v4.0.17

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.