Repository navigation
Update dependency SixLabors.ImageSharp to v2 [SECURITY] - autoclosed - #23
Closed
renovate[bot] wants to merge 1 commit into
Closed
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/nuget-sixlabors.imagesharp-vulnerability
branch
2 times, most recently
from
September 17, 2026 13:39
17d28c9 to
f07cd85
Compare
renovate
Bot
force-pushed
the
renovate/nuget-sixlabors.imagesharp-vulnerability
branch
from
October 1, 2026 05:28
f07cd85 to
6d549fd
Compare
renovate
Bot
deleted the
renovate/nuget-sixlabors.imagesharp-vulnerability
branch
October 11, 2026 16:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.0.4→2.1.11Use After Free in SixLabors.ImageSharp
CVE-2024-27929 / GHSA-65x7-c272-7g7r
More information
Details
Impact
A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.3 or v2.1.7.
Workarounds
None
References
None
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value
CVE-2024-32035 / GHSA-g85r-6x2q-45w7
More information
Details
Impact
A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.
This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8.
Workarounds
Before calling
Image.Decode(Async), useImage.Identifyto determine the image dimensions in order to enforce a limit.References
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SixLabors.ImageSharp vulnerable to data leakage
CVE-2024-32036 / GHSA-5x7m-6737-26cr
More information
Details
Impact
A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.4 or v2.1.8.
Workarounds
None
References
None
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SixLabors ImageSharp Out-of-bounds Write
CVE-2024-41131 / GHSA-63p8-c4ww-9cg7
More information
Details
Impact
An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.
Workarounds
None.
References
https://github.com/SixLabors/ImageSharp/pull/2754
https://github.com/SixLabors/ImageSharp/pull/2756
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder
CVE-2024-41132 / GHSA-qxrv-gp6x-rc23
More information
Details
Impact
What kind of vulnerability is it? Who is impacted?
A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Before calling
Image.Decode(Async), useImage.Identifyto determine the image dimensions in order to enforce a limit.References
Are there any links users can visit to find out more?
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Out-of-bounds Write in SixLabors ImageSharp
CVE-2025-27598 / GHSA-2cmq-823j-5qj8
More information
Details
Impact
An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10.
Workarounds
None.
References
https://github.com/SixLabors/ImageSharp/issues/2859
https://github.com/SixLabors/ImageSharp/issues/2890
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks
CVE-2025-54575 / GHSA-rxmq-m78w-7wmc
More information
Details
Impact
A specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version.
Patches
The problem has been patched. All users are advised to upgrade to v3.1.11 or v2.1.11.
Workarounds
None.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
SixLabors/ImageSharp (SixLabors.ImageSharp)
v2.1.11What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.10...v2.1.11
v2.1.10What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.9...v2.1.10
v2.1.9What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.8...v2.1.9
v2.1.8What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.7...v2.1.8
v2.1.7What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.6...v2.1.7
v2.1.6What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.5...v2.1.6
v2.1.5What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.4...v2.1.5
v2.1.4What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.3...v2.1.4
v2.1.3What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.2...v2.1.3
v2.1.2What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.1...v2.1.2
v2.1.1What's Changed
Full Changelog: SixLabors/ImageSharp@v2.1.0...v2.1.1
v2.1.0Advisories and Breaking Changes
Release Notes
Area:Performance
Bug
Codequality
Documentation
Enhancement
Formats:Jpeg
Formats:Png
Formats:Tiff
Metadata:Exif
Other
Unit Tests
New Contributors
Full Changelog: SixLabors/ImageSharp@v2.0.0...v2.1.0
v2.0.0Advisories and Breaking Changes
Major breaking changes
GetPixelRowSpan()methods have been replaced withProcessPixelRows()variants. This was done to guarantee memory safety. For more details see:Image<Rgb24>instead ofImage<Rgba32>.) This was done to reduce memory usage and remove some surprises for users.Complete list of breaking PR-s
Release Notes
API
Area:Build
Area:Formats
Area:Performance
Bug
Codequality
Enhancement
Formats:Jpeg
Formats:Png
Formats:Webp
Other
Unit Tests
New Contributors
Full Changelog: SixLabors/ImageSharp@v1.0.4...v2.0.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.