GHSA-44p7-9xx4-hf2g

Go Images vulnerable to an out-of-memory error via a crafted TIFF file

En bref

Publiée: 2026-03-25 21:30 UTC
Mise à jour: 2026-09-10 03:50 UTC
CVE: CVE-2026-33809
Alias: GO-2026-4815
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Paquets affectés

Paquet	Versions
Go · golang.org/x/image	introduced 0, fixed 0.38.0

Références

https://nvd.nist.gov/vuln/detail/CVE-2026-33809 ADVISORY
https://cs.opensource.google/go/x/image PACKAGE
https://go.dev/cl/757660 WEB
https://go.dev/issue/78267 WEB
https://pkg.go.dev/vuln/GO-2026-4815 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database