Vulnerability GO-2026-5031
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 29, 2026 at 06:17 PM UTC
Panic when reading out of bound palette index in golang.org/x/image/bmp
<0.41.0
<0.41.0
Summary
Panic when reading out of bound palette index in golang.org/x/image/bmp
Details
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 months ago
Excessive memory allocation during VP8L decoding in golang.org/x/image
<0.45.0 GO-2026-6222
<0.45.0 GO-2026-6222
High Risk
4 months ago
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
<0.41.0 GHSA-q675-qj96-32m9
<0.41.0 GHSA-q675-qj96-32m9
Unknown
4 months ago
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
<0.43.0 GO-2026-5066
<0.43.0 GO-2026-5066
Unknown
4 months ago
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
<0.43.0 GO-2026-5062
<0.43.0 GO-2026-5062
Unknown
4 months ago
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
<0.43.0 GO-2026-5061
<0.43.0 GO-2026-5061
Impacted packages
Timeline
Published
5 months ago
May 29, 2026 at 06:17 PM UTC
Fixed (v0.41.0)
5 months ago
May 21, 2026 at 08:57 PM UTC
Last Modified
6 hours ago
November 14, 2026 at 01:12 PM UTC