---
id: GO-2026-6895
aliases:
  - GHSA-494m-4556-wf5p
title: >-
  imgproxy has out-of-bounds heap read/write in ICO loader BMP header
  reconstruction that allows unauthenticated remote worker crash in git…
summary: >-
  imgproxy has out-of-bounds heap read/write in ICO loader BMP header
  reconstruction that allows unauthenticated remote worker crash in
  github.com/imgproxy/imgproxy
severity: none
vendor: imgproxy
product: github.com/imgproxy/imgproxy
ecosystem: go
affected:
  - github.com/imgproxy/imgproxy
  - github.com/imgproxy/imgproxy/v2
  - github.com/imgproxy/imgproxy/v3 >= 3.3.0
  - github.com/imgproxy/imgproxy/v4 < 4.0.17
patched:
  - github.com/imgproxy/imgproxy/v4 4.0.17
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T23:15:18.150077398Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6895'
references:
  - url: >-
      https://github.com/imgproxy/imgproxy/security/advisories/GHSA-494m-4556-wf5p
  - url: >-
      https://github.com/imgproxy/imgproxy/commit/39fd9e844a8a46084161502e993d5a3c16ccf28d
  - url: 'https://github.com/imgproxy/imgproxy/pull/1726'
  - url: 'https://github.com/imgproxy/imgproxy/releases/tag/v4.0.17'
tags:
  - osv
  - go
ingestedAt: '2026-11-07T16:33:46.908Z'
---

## Overview

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy

## Affected packages

- `github.com/imgproxy/imgproxy`
- `github.com/imgproxy/imgproxy/v2`
- `github.com/imgproxy/imgproxy/v3 >= 3.3.0`
- `github.com/imgproxy/imgproxy/v4 < 4.0.17`

## Remediation

Upgrade to a patched release:

- `github.com/imgproxy/imgproxy/v4 4.0.17`