CVE-2026-123616 · Runtime
NO FIX YET · SEE WHAT TO DO
imgproxy, an image processing server, fails to validate the data_size field in its ICO image loader. A crafted 23-byte ICO file declaring about 4GB of data can exhaust memory and crash worker processes.
first public Oct 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any imgproxy deployment from 3.3.0 before 4.0.16 that processes ICO images is exposed; the sources describe no authentication requirement. Teams that run imgproxy only on fully trusted inputs or on a version at or above 4.0.16 can skip it.
Not affected if version-4.0.16-or-later
Who cares image-processing, imgproxy, self-hosted
imgproxy -v or the container image tag.3.3.0 before 4.0.16: move to 4.0.16 or later.imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.