---
id: GO-2026-6897
aliases:
  - GHSA-hff9-5pqw-6w9f
title: >-
  imgproxy has integer overflow in imgproxy ICO loader that causes denial of
  service and may permit remote code execution in github.com/img…
summary: >-
  imgproxy has integer overflow in imgproxy ICO loader that causes denial of
  service and may permit remote code execution in github.com/imgproxy/imgproxy
severity: none
vendor: imgproxy
product: github.com/imgproxy/imgproxy
ecosystem: go
affected:
  - github.com/imgproxy/imgproxy
  - github.com/imgproxy/imgproxy/v2
  - github.com/imgproxy/imgproxy/v3
  - 'github.com/imgproxy/imgproxy/v4 >= 4.0.0, < 4.0.16'
patched:
  - github.com/imgproxy/imgproxy/v4 4.0.16
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T23:15:16.070560377Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6897'
references:
  - url: >-
      https://github.com/imgproxy/imgproxy/security/advisories/GHSA-hff9-5pqw-6w9f
  - url: >-
      https://github.com/imgproxy/imgproxy/commit/a821b6a4cb07a1bf2bb9077431d1c1e734d79917
  - url: 'https://github.com/imgproxy/imgproxy/releases/tag/v4.0.16'
tags:
  - osv
  - go
ingestedAt: '2026-11-07T16:33:46.909Z'
---

## Overview

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgproxy/imgproxy

## Affected packages

- `github.com/imgproxy/imgproxy`
- `github.com/imgproxy/imgproxy/v2`
- `github.com/imgproxy/imgproxy/v3`
- `github.com/imgproxy/imgproxy/v4 >= 4.0.0, < 4.0.16`

## Remediation

Upgrade to a patched release:

- `github.com/imgproxy/imgproxy/v4 4.0.16`