Vulnerability GO-2026-5061
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 months ago
June 18, 2026 at 10:46 PM UTC
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
<0.43.0
<0.43.0
Summary
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
Details
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 months ago
Excessive memory allocation during VP8L decoding in golang.org/x/image
<0.45.0 GO-2026-6222
<0.45.0 GO-2026-6222
High Risk
4 months ago
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
<0.41.0 GHSA-q675-qj96-32m9
<0.41.0 GHSA-q675-qj96-32m9
Unknown
4 months ago
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
<0.43.0 GO-2026-5066
<0.43.0 GO-2026-5066
Unknown
4 months ago
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
<0.43.0 GO-2026-5062
<0.43.0 GO-2026-5062
Unknown
5 months ago
Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
<0.41.0 GO-2026-5032
<0.41.0 GO-2026-5032
Impacted packages
Timeline
Published
4 months ago
June 18, 2026 at 10:46 PM UTC
Fixed (v0.43.0)
5 months ago
June 15, 2026 at 11:26 PM UTC
Last Modified
4 months ago
June 26, 2026 at 01:44 PM UTC