VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jan 27, 2025· Updated Apr 15, 2026

CVE-2025-24354

CVE-2025-24354

Description

imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/imgproxy/imgproxyGo
< 3.27.23.27.2

Patches

2
d7731dc3860e
https://github.com/imgproxy/imgproxyvia osv
3d4fed6842aa

Fix for GHSA-j2hp-6m75-v4j4

https://github.com/imgproxy/imgproxyBen AubinJan 19, 2025via ghsa
commit
1 file changed · +1 −1
  • security/source.go+1 −1 modified
    @@ -41,7 +41,7 @@ func VerifySourceNetwork(addr string) error {
 		return ErrInvalidSourceAddress
 	}
 
-	if !config.AllowLoopbackSourceAddresses && ip.IsLoopback() {
+	if !config.AllowLoopbackSourceAddresses && (ip.IsLoopback() || ip.IsUnspecified()) {
 		return ErrSourceAddressNotAllowed
 	}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.