Fluid Attacks Database

Description

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	golang-golang-x-image	=0.11.0-1 \|\| =0.12.0-1 \|\| =0.13.0-1 \|\| =0.14.0-1 \|\| =0.15.0-1 \|\| =0.16.0-1 \|\| =0.18.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1 \|\| =0.42.0-1 \|\| =0.45.0-1 \|\| =0.5.0-1 \|\| =0.7.0-1 \|\| =0.8.0-1 \|\| =0.9.0-1	-
debian 14	golang-golang-x-image	=0.18.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1 \|\| =0.42.0-1 \|\| >=0 <0.45.0-1	0.45.0-1
debian 13	golang-golang-x-image	=0.18.0-1 \|\| =0.32.0-1 \|\| =0.35.0-1 \|\| =0.38.0-1 \|\| =0.39.0-1 \|\| =0.42.0-1 \|\| =0.45.0-1	-
go	golang.org/x/image	>=0 <0.45.0	0.45.0

Aliases

1. CVE-2026-466032. NVD-2026-466033. OSV-DEBIAN-2026-466034. OSV-2026-466035. OSV-GO-2026-62226. GCVE-2026-466037. SECURITY-TRACKER-CVE-2026-46603

References

1. https://go.dev/issue/800692. https://go.dev/cl/793460

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.