---
id: GO-2026-6898
aliases:
  - GHSA-mmq5-xm89-9pfg
title: >-
  imgproxy has unbounded memory allocation in ICO loader that allows
  unauthenticated memory-exhaustion DoS via crafted data_size field in g…
summary: >-
  imgproxy has unbounded memory allocation in ICO loader that allows
  unauthenticated memory-exhaustion DoS via crafted data_size field in
  github.com/imgproxy/imgproxy
severity: none
vendor: imgproxy
product: github.com/imgproxy/imgproxy
ecosystem: go
affected:
  - github.com/imgproxy/imgproxy
  - github.com/imgproxy/imgproxy/v2
  - github.com/imgproxy/imgproxy/v3 >= 3.3.0
  - github.com/imgproxy/imgproxy/v4 < 4.0.16
patched:
  - github.com/imgproxy/imgproxy/v4 4.0.16
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T23:15:16.466059849Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6898'
references:
  - url: >-
      https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg
  - url: >-
      https://github.com/imgproxy/imgproxy/commit/a821b6a4cb07a1bf2bb9077431d1c1e734d79917
  - url: 'https://github.com/imgproxy/imgproxy/releases/tag/v4.0.16'
tags:
  - osv
  - go
ingestedAt: '2026-11-07T16:33:46.909Z'
---

## Overview

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in github.com/imgproxy/imgproxy

## Affected packages

- `github.com/imgproxy/imgproxy`
- `github.com/imgproxy/imgproxy/v2`
- `github.com/imgproxy/imgproxy/v3 >= 3.3.0`
- `github.com/imgproxy/imgproxy/v4 < 4.0.16`

## Remediation

Upgrade to a patched release:

- `github.com/imgproxy/imgproxy/v4 4.0.16`