Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: imgproxy 4.0.16 Clear all filters
TI-2026-86758 CVE-2026-123616 · GHSA-97wv-7mx5-f6w4

Memory exhaustion in imgproxy ICO loader enables denial of service

Priority LOW 38

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00474 Published 2026-11-08 Fixed in 4.0.16 CWE-789
TI-2026-86756 CVE-2026-123614 · GHSA-p65x-p3jr-w89f

Heap buffer overflow in imgproxy ICO loader lets attackers crash or run code

Priority MEDIUM 41

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00657 Published 2026-11-08 Fixed in 4.0.16 CWE-122