PkgSeer

Vulnerability GO-2026-5032

Unknown

5 months ago

Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff

<0.41.0

Summary

Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff

Details

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Excessive memory allocation during VP8L decoding in golang.org/x/image

<0.45.0 GO-2026-6222

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

<0.41.0 GHSA-q675-qj96-32m9

Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

<0.43.0 GO-2026-5066

Lack of limit on tile sizes in x/image/tiff in golang.org/x/image

<0.43.0 GO-2026-5062

Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

<0.43.0 GO-2026-5061

View all vulnerabilities for these packages

Impacted packages

golang.org/x/image

Timeline

Published

5 months ago

Fixed (v0.41.0)

5 months ago

Last Modified

4 months ago