Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 5 November 2026.

Which products and versions are affected?

github.com/imgproxy/imgproxy (Go) SEMVER:introduced=0; github.com/imgproxy/imgproxy/v2 (Go) SEMVER:introduced=0; github.com/imgproxy/imgproxy/v3 (Go) SEMVER:introduced=3.3.0; github.com/imgproxy/imgproxy/v4 (Go) SEMVER:introduced=0,fixed=4.0.16; and 1 more.

Is there a fix for This vulnerability?

Yes. github.com/imgproxy/imgproxy/v4 (Go): upgrade to 4.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run github.com/imgproxy/imgproxy (Go), github.com/imgproxy/imgproxy/v2 (Go), github.com/imgproxy/imgproxy/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

imgproxy unbounded memory allocation in ICO loader

Severity: info · Published 2026-11-05

imgproxy is an image processing service that handles image format conversion and optimization. An attacker can send a maliciously crafted ICO (icon) image file that causes the service to allocate gigabytes of memory, crashing worker processes or exhausting system resources without requiring authentication. This enables a denial-of-service attack against any deployment processing untrusted images.

Technologies: github.com/imgproxy/imgproxy (Go), github.com/imgproxy/imgproxy/v2 (Go), github.com/imgproxy/imgproxy/v3 (Go), github.com/imgproxy/imgproxy/v4 (Go), Imgproxy. Vendors: Go, Imgproxy.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 5 November 2026.
Which products and versions are affected?: github.com/imgproxy/imgproxy (Go) SEMVER:introduced=0; github.com/imgproxy/imgproxy/v2 (Go) SEMVER:introduced=0; github.com/imgproxy/imgproxy/v3 (Go) SEMVER:introduced=3.3.0; github.com/imgproxy/imgproxy/v4 (Go) SEMVER:introduced=0,fixed=4.0.16; and 1 more.
Is there a fix for This vulnerability?: Yes. github.com/imgproxy/imgproxy/v4 (Go): upgrade to 4.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run github.com/imgproxy/imgproxy (Go), github.com/imgproxy/imgproxy/v2 (Go), github.com/imgproxy/imgproxy/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/imgproxy/imgproxy/v4 (Go): upgrade to 4.0.16 or later
```
go get github.com/imgproxy/imgproxy/v4@v4.0.16
```

Technical details

The ICO loader in vips/icoload.c reads an unvalidated data_size field (u32) from the ICO directory entry and passes it directly to VIPS_MALLOC without bounds checking, allowing allocation of up to ~4GB from a single 23-byte crafted file. The vulnerability affects imgproxy versions 3.3.0 through 4.0.15, exploitable via network without authentication or user interaction, causing memory exhaustion and worker crashes or sustained transient allocations.

Affected products

imgproxy imgproxy 3.3.0 to 4.0.15

Identifiers

GHSA-mmq5-xm89-9pfg
GO-2026-6898

Timeline

2026-10-06: disclosed
2026-11-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.