Memory Exhaustion Vulnerability in imgproxy from Vendor imgproxy

CVE-2026-123616

What is CVE-2026-123616?

imgproxy versions prior to 4.0.16 are susceptible to a memory exhaustion vulnerability within the ICO loader. The vulnerability arises from the lack of validation for the data_size field, allowing malicious actors to craft a 23-byte ICO file with a misleadingly large data_size of approximately 4GB. Exploitation of this flaw can lead to memory exhaustion, resulting in worker crashes that can disrupt services, all without requiring any form of authentication.

References