A vulnerability in imgproxy versions from 3.3.0 up to but not including 4.0.16 allows attackers to cause unbounded memory allocation via a crafted ICO file. The flaw arises because the ICO loader does not validate the data_size field, enabling memory exhaustion and worker crashes without requiring authentication.