github.com/imgproxy/imgproxy/v3 vulnerabilities
CVEs whose affected-version data names the github.com/imgproxy/imgproxy/v3 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
GO-2026-6898Noneimgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in g…
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in github.com/imgproxy/imgproxy
GO-2026-6897Noneimgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/img…
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgproxy/imgproxy
GO-2026-6895Noneimgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in git…
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy
GHSA-mmq5-xm89-9pfgHigh· 7.5imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
GHSA-hff9-5pqw-6w9fCritical· 9.8imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
GHSA-494m-4556-wf5pHigh· 7.5imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash