Vulnerability GHSA-q675-qj96-32m9
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
July 02, 2026 at 09:01 PM UTC
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
<0.41.0
<0.41.0
Summary
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
Details
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 months ago
Excessive memory allocation during VP8L decoding in golang.org/x/image
<0.45.0 GO-2026-6222
<0.45.0 GO-2026-6222
Unknown
4 months ago
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
<0.43.0 GO-2026-5066
<0.43.0 GO-2026-5066
Unknown
4 months ago
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
<0.43.0 GO-2026-5062
<0.43.0 GO-2026-5062
Unknown
4 months ago
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
<0.43.0 GO-2026-5061
<0.43.0 GO-2026-5061
Unknown
5 months ago
Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
<0.41.0 GO-2026-5032
<0.41.0 GO-2026-5032
Impacted packages
Timeline
Published
4 months ago
July 02, 2026 at 09:01 PM UTC
Fixed (v0.41.0)
5 months ago
May 21, 2026 at 08:57 PM UTC
Last Modified
2 months ago
September 10, 2026 at 03:51 AM UTC