Three imgproxy flaws get CVE records. Check the running build

A shop might use imgproxy to retrieve a product photo and turn it into a small preview. The program reads the image format and its internal labels to determine what to unpack and how much working memory to reserve. ICO is a format commonly used for icons. In a fictional shop that accepts an outside seller’s image URL, a request for a preview can lead the server to fetch and open an ICO file chosen by that seller. Whether that route exists depends on the shop’s source restrictions and request controls.

One flaw occurs when the file claims an unusually large size. The reader adds space for a header, and the result wraps back to a small number, like a counter rolling over. On a fictional two-digit counter, adding 5 to 98 gives 103, but the display wraps to 03. The image reader uses a much larger limit, but the same kind of wrap leaves too little working space. When it starts copying the image bytes, they can extend into memory used for other work. A different flaw can reserve far too much memory and make the worker stop. Undersized allocation advisory · Excessive allocation advisory

Each row gives the affected versions and the first version the maintainer identifies as fixed for that issue. A running v4.0.16 instance crosses the first two boundaries and still falls within the third affected range.