Imageflow.NativeRuntime.win-x86

Version	Released
`2.3.1-rc01` pre	Mar 31, 2026
`2.2.0-rc01` pre	Oct 23, 2025
`2.1.2-rc03` pre	Oct 20, 2025
`2.1.2-rc02` pre	Oct 16, 2025
`2.1.2-rc01` pre	Sep 23, 2025
`2.1.1-rc11` pre	Jul 04, 2025
`2.1.1-rc10` pre	Jun 18, 2025
`2.1.1-rc09` pre	Jun 13, 2025
`2.1.0-rc11` pre	Feb 19, 2025
`2.1.0-rc10` pre	Feb 19, 2025
`2.1.0-rc09` pre	Feb 19, 2025
`2.1.0-rc08` pre	Feb 19, 2025
`2.1.0-rc07` pre	Feb 19, 2025
`2.1.0-rc06` pre	Feb 19, 2025
`2.1.0-rc05` pre	Feb 19, 2025
`2.1.0-rc02` pre	Feb 07, 2025
`2.1.0-rc01` pre	Jan 29, 2025
`2.0.1-rc04` pre	Jan 22, 2025
`2.0.1-rc-2` pre	Jan 21, 2025
`2.0.0-preview8` pre	Sep 26, 2023
`2.0.0-preview5` pre 1 CVE	Apr 03, 2023
`2.0.0-preview4` pre 1 CVE	Jan 06, 2023
`2.0.0-preview3` pre 1 CVE	Dec 23, 2022
`2.0.0-preview2` pre 1 CVE	Nov 21, 2022
`2.0.0-preview1` pre 1 CVE	Sep 29, 2022
`1.7.3-rc67` pre 1 CVE	Aug 04, 2022
`1.7.1-rc65` pre 1 CVE	Jun 09, 2022
`1.7.0-rc64` pre 1 CVE	May 21, 2022
`1.6.0-rc63` pre 1 CVE	May 19, 2022
`1.5.8-rc62` pre 1 CVE	Mar 29, 2021
`1.5.7-rc61` pre 1 CVE	Mar 18, 2021
`1.5.6-rc60` pre 1 CVE	Mar 13, 2021
`1.5.5-rc59` pre 1 CVE	Dec 27, 2020
`1.5.4-rc58` pre 1 CVE	Dec 10, 2020
`1.5.3-rc57` pre 1 CVE	Nov 22, 2020
`1.5.2-rc56` pre 1 CVE	Nov 11, 2020
`1.5.0-rc54` pre 1 CVE	Nov 09, 2020
`1.4.13-rc53` pre 1 CVE	Oct 29, 2020
`1.4.12-rc52` pre 1 CVE	Oct 25, 2020
`1.4.11-rc51` pre 1 CVE	Sep 22, 2020
`1.4.10-rc50` pre 1 CVE	Jul 05, 2020
`1.4.9-rc49` pre 1 CVE	Jul 04, 2020
`1.4.8-rc48` pre 1 CVE	Jul 03, 2020
`1.4.6-rc46` pre 1 CVE	Jul 01, 2020
`1.4.5-rc45` pre 1 CVE	Jun 17, 2020
`1.4.4-rc44` pre 1 CVE	Jun 11, 2020
`1.4.3-rc43` pre 1 CVE	Jun 10, 2020
`1.4.2-rc42` pre 1 CVE	Jun 10, 2020
`1.4.1-rc41` pre 1 CVE	Jun 09, 2020
`1.4.0-rc40` pre 1 CVE	May 11, 2020

2.3.1-rc01 pre

Mar 31, 2026

2.2.0-rc01 pre

Oct 23, 2025

2.1.2-rc03 pre

Oct 20, 2025

2.1.2-rc02 pre

Oct 16, 2025

2.1.2-rc01 pre

Sep 23, 2025

2.1.1-rc11 pre

Jul 04, 2025

2.1.1-rc10 pre

Jun 18, 2025

2.1.1-rc09 pre

Jun 13, 2025

2.1.0-rc11 pre

Feb 19, 2025

2.1.0-rc10 pre

Feb 19, 2025

2.1.0-rc09 pre

Feb 19, 2025

2.1.0-rc08 pre

Feb 19, 2025

2.1.0-rc07 pre

Feb 19, 2025

2.1.0-rc06 pre

Feb 19, 2025

2.1.0-rc05 pre

Feb 19, 2025

2.1.0-rc02 pre

Feb 07, 2025

2.1.0-rc01 pre

Jan 29, 2025

2.0.1-rc04 pre

Jan 22, 2025

2.0.1-rc-2 pre

Jan 21, 2025

2.0.0-preview8 pre

Sep 26, 2023

2.0.0-preview5 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 03, 2023

2.0.0-preview4 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 06, 2023

2.0.0-preview3 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 23, 2022

2.0.0-preview2 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 21, 2022

2.0.0-preview1 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 29, 2022

1.7.3-rc67 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2022

1.7.1-rc65 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 09, 2022

1.7.0-rc64 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

May 21, 2022

1.6.0-rc63 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

May 19, 2022

1.5.8-rc62 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 29, 2021

1.5.7-rc61 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 18, 2021

1.5.6-rc60 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 13, 2021

1.5.5-rc59 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 27, 2020

1.5.4-rc58 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 10, 2020

1.5.3-rc57 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 22, 2020

1.5.2-rc56 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 11, 2020

1.5.0-rc54 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 09, 2020

1.4.13-rc53 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 29, 2020

1.4.12-rc52 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 25, 2020

1.4.11-rc51 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 22, 2020

1.4.10-rc50 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 05, 2020

1.4.9-rc49 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 04, 2020

1.4.8-rc48 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 03, 2020

1.4.6-rc46 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 01, 2020

1.4.5-rc45 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 17, 2020

1.4.4-rc44 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 11, 2020

1.4.3-rc43 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 10, 2020

1.4.2-rc42 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 10, 2020

1.4.1-rc41 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 09, 2020

1.4.0-rc40 pre

1 CVE

GHSA-7vpr-3ppw-qrpj Sep 27, 2023

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

8.8 / 10

High

Network Low None Required Unchanged High High High

Impact

This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway).

Imageflow relies on Google's [libwebp] library to decode .webp images, and is affected by the recent zero-day out-of-bounds write vulnerability CVE-2023-4863 and https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. The libwebp vulnerability also affects Chrome, Android, macOS, and other consumers of the library).

libwebp patched the vulnerability and released 1.3.2

This was patched in libwebp-sys in 0.9.3 and 0.9.4

Imageflow v2.0.0-preview8 uses the patched version of libwebp as well as updated versions of all dependencies.

Note: preview 8 requires libc 2.31 or higher on linux and macOS 11 or higher. These restrictions are due to the oldest supported versions of those platforms (which is reflected on Github Actions).

Patches

Imageflow v2.0.0-preview8 use the patched version (v1.3.2) of libwebp and libwebp-sys 0.9.4. Imageflow.AllPlatforms 0.10.2 is patched Imageflow.Server v0.8.2 is patched ImageResizer.Plugins.Imageflow 5.0.12 is patched

Workarounds

Disable webp decoding using EnabledCodecs::disable_decoder(NamedDecoders::WebPDecoder) if using the Rust API.

Only files that meet the following criteria will be passed to libwebp:

bytes.starts_with(b"RIFF") && bytes[8..12].starts_with(b"WEBP")

You can utilize matching logic to block webp inputs in your language of choice.

References

https://github.com/advisories/GHSA-j7hp-h8jx-5ppr https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://github.com/webmproject/libwebp/commit/2af26267cdfcb63a88e5c74a85927a12d6ca1d76 https://github.com/NoXF/libwebp-sys/commits/master

Affected versions


          1.0.0-rc1-1


          1.0.0-rc10


          1.0.0-rc11


          1.0.0-rc12


          1.0.0-rc13


          1.0.0-rc14


          1.0.0-rc3a


          1.0.0-rc5a


          1.0.0-rc6


          1.0.0-rc7


          1.0.0-rc8


          1.0.0-rc9

+ 47 more


            1.1.0-rc18


            1.2.0-rc20


            1.2.0-rc22


            1.2.0-rc24


            1.2.0-rc25


            1.2.0-rc26


            1.2.1-rc28


            1.2.2-rc29


            1.3.0-rc30


            1.3.2-rc32


            1.3.3-rc33


            1.3.4-rc34


            1.3.5-rc35


            1.3.6-rc36


            1.3.7-rc37


            1.3.8-rc38


            1.3.9-rc39


            1.4.0-rc40


            1.4.1-rc41


            1.4.10-rc50


            1.4.11-rc51


            1.4.12-rc52


            1.4.13-rc53


            1.4.2-rc42


            1.4.3-rc43


            1.4.4-rc44


            1.4.5-rc45


            1.4.6-rc46


            1.4.8-rc48


            1.4.9-rc49


            1.5.0-rc54


            1.5.2-rc56


            1.5.3-rc57


            1.5.4-rc58


            1.5.5-rc59


            1.5.6-rc60


            1.5.7-rc61


            1.5.8-rc62


            1.6.0-rc63


            1.7.0-rc64


            1.7.1-rc65


            1.7.3-rc67


            2.0.0-preview1


            2.0.0-preview2


            2.0.0-preview3


            2.0.0-preview4


            2.0.0-preview5

Fixed in


          2.0.0-preview6

References

Updated Sep 10, 2026 · Source: OSV.dev

May 11, 2020

Activity

Details