imgproxy: Unbounded memory allocation in ICO loader (CVE-2026-123616)

imgproxy versions 3.3.0 through 4.0.15 are affected by an unbounded memory allocation vulnerability (CVE-2026-123616) in the ICO image processing module. The loader fails to validate the data_size field in processed ICO files. An attacker can submit a crafted 23-byte ICO file specifying a data_size of approximately 4GB, causing the service to allocate excessive memory, leading to worker process exhaustion and crashes.

Impact

Successful exploitation results in a denial-of-service condition for the imgproxy instance by inducing memory exhaustion and crashing worker processes.

Recommendation

• Upgrade imgproxy instances to version 4.0.16 or later to include the mandatory validation of the data_size field in the ICO loader.
• Implement request body size limits at the load balancer or reverse proxy level (e.g., Nginx client_max_body_size) if immediate patching is not feasible, though this will not prevent the specific vulnerability if small-file payloads are allowed.
• Monitor logs for repeated worker process restarts or high memory usage spikes correlated with image processing tasks.