GO-2023-1990

Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff

At a glance

Published: 2023-08-02 15:06 UTC
Updated: 2024-05-20 16:03 UTC
CVE: CVE-2023-29407
Aliases: GHSA-j3p8-6mrq-6g7h

Description

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

Affected packages

Package	Versions
Go · golang.org/x/image	introduced 0, fixed 0.10.0

References

https://go.dev/issue/61581 REPORT
https://go.dev/cl/514897 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database