imgproxy has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 6. The median CVSS is 7.5 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: github.com/imgproxy/imgproxy (3), github.com/imgproxy/imgproxy/v3 (3), imgproxy (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Products
- github.com/imgproxy/imgproxy 3
- github.com/imgproxy/imgproxy/v3 3
- imgproxy 3
Worst active — by depth score
CVE-2026-123614Critical· 9.8imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow54GHSA-hff9-5pqw-6w9fCritical· 9.8imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution54CVE-2026-123616High· 7.5imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader41CVE-2026-123615High· 7.5imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader41GHSA-mmq5-xm89-9pfgHigh· 7.5imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field41
imgproxy vulnerabilities
CVEs affecting imgproxy, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-123616High· 7.5imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger m…
CVE-2026-123615High· 7.5imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated he…
CVE-2026-123614Critical· 9.8imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps…
GO-2026-6898Noneimgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in g…
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in github.com/imgproxy/imgproxy
GO-2026-6897Noneimgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/img…
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in github.com/imgproxy/imgproxy
GO-2026-6895Noneimgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in git…
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in github.com/imgproxy/imgproxy
GHSA-mmq5-xm89-9pfgHigh· 7.5imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
GHSA-hff9-5pqw-6w9fCritical· 9.8imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
GHSA-494m-4556-wf5pHigh· 7.5imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash