Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.5, published 30 October 2026.

Which products and versions are affected?

github.com/imgproxy/imgproxy/v3 (Go) >= 3.3.0, <= 4.0.15, SEMVER:introduced=3.3.0,fixed=4.0.16; Imgproxy v4.0.15 and 3.3.x series.

Is there a fix for This vulnerability?

Yes. github.com/imgproxy/imgproxy/v3 (Go): upgrade to 4.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run github.com/imgproxy/imgproxy/v3 (Go) or Imgproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

imgproxy unbounded memory allocation in ICO loader

Q: Is there a fix for This vulnerability?

Yes. github.com/imgproxy/imgproxy/v3 (Go): upgrade to 4.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected?

Check whether you run github.com/imgproxy/imgproxy/v3 (Go) or Imgproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 7.5 · Published 2026-10-30

imgproxy is an image processing server that handles image format conversion and optimization. An attacker can send a specially crafted 23-byte ICO (icon) file that triggers a ~4GB memory allocation attempt, causing worker process crashes or sustained memory exhaustion. This requires no authentication and can be exploited repeatedly to exhaust available memory on the host.

Technologies: github.com/imgproxy/imgproxy/v3 (Go), Imgproxy. Vendors: Go, Imgproxy.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.5, published 30 October 2026.
Which products and versions are affected?: github.com/imgproxy/imgproxy/v3 (Go) >= 3.3.0, <= 4.0.15, SEMVER:introduced=3.3.0,fixed=4.0.16; Imgproxy v4.0.15 and 3.3.x series.
Is there a fix for This vulnerability?: Yes. github.com/imgproxy/imgproxy/v3 (Go): upgrade to 4.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run github.com/imgproxy/imgproxy/v3 (Go) or Imgproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/imgproxy/imgproxy/v3 (Go): upgrade to 4.0.16 or later
```
go get github.com/imgproxy/imgproxy/v3@v4.0.16
```

Technical details

The ICO loader in vips/icoload.c reads an untrusted data_size field (u32) from the ICO directory entry and passes it directly to VIPS_MALLOC without validation. No bounds check occurs on the allocation size, and no verification is performed that the file actually contains the declared amount of data. An attacker sending a crafted ICO file with data_size set to 0xfa000068 (~4GB) causes an immediate ~4GB allocation attempt, leading to out-of-memory conditions or worker crashes.

Affected products

imgproxy imgproxy v4.0.15 and 3.3.x series

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.