Most recent entries from all

EUVD-2026-215300

fkie_cve-2025-24354

imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.

GHSA-j2hp-6m75-v4j4 — imgproxy is vulnerable to SSRF against 0.0.0.0

Affected: Go: github.com/imgproxy/imgproxy

### Summary

Imgproxy does not block the `0.0.0.0` address, even with `IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES` set to false. This can expose services on the local host.

### Details

imgproxy protects against SSRF against a loopback address with the following check ([source](https://github.com/imgproxy/imgproxy/blob/0f37d62fd8326a32c213b30dd52e2319770885d8/security/source.go#L43C1-L47C1)):

``` if !config.AllowLoopbackSourceAddresses && ip.IsLoopback() { return ErrSourceAddressNotAllowed } ```

This check is insufficient to prevent accessing services on the local host, as services may receive traffic on `0.0.0.0`. Go's `IsLoopback` ([source](https://github.com/golang/go/blob/40b3c0e58a0ae8dec4684a009bf3806769e0fc41/src/net/ip.go#L126-L131)) strictly follows the definition of loopback IPs beginning with `127`. `0.0.0.0` is not blocked.

openSUSE-SU-2025:14710-1 — govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media

govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media

SUSE-SU-2025:0297-1 — Security update for govulncheck-vulndb

Security update for govulncheck-vulndb