Impact

Successful exploitation results in a denial-of-service condition for the imgproxy instance by inducing memory exhaustion and crashing worker processes.

Recommendation

• Upgrade imgproxy instances to version 4.0.16 or later to include the mandatory validation of the data_size field in the ICO loader.
• Implement request body size limits at the load balancer or reverse proxy level (e.g., Nginx client_max_body_size) if immediate patching is not feasible, though this will not prevent the specific vulnerability if small-file payloads are allowed.
• Monitor logs for repeated worker process restarts or high memory usage spikes correlated with image processing tasks.