Vulnerability Report: GO-2026-6222
- CVE-2026-46603
- Affects: golang.org/x/image
- Published: Aug 14, 2026
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
Affected Packages
-
PathVersionsSymbols
-
before v0.45.0
Aliases
References
Credits
- Daniele Ballarini
Feedback
See anything missing or incorrect?
Suggest an edit to this report.