Vulnerability GO-2026-5062
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 months ago
June 18, 2026 at 10:50 PM UTC
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
<0.43.0
<0.43.0
Summary
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
Details
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 months ago
Excessive memory allocation during VP8L decoding in golang.org/x/image
<0.45.0 GO-2026-6222
<0.45.0 GO-2026-6222
High Risk
4 months ago
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
<0.41.0 GHSA-q675-qj96-32m9
<0.41.0 GHSA-q675-qj96-32m9
Unknown
4 months ago
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
<0.43.0 GO-2026-5066
<0.43.0 GO-2026-5066
Unknown
4 months ago
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
<0.43.0 GO-2026-5061
<0.43.0 GO-2026-5061
Unknown
5 months ago
Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
<0.41.0 GO-2026-5032
<0.41.0 GO-2026-5032
Impacted packages
Timeline
Published
4 months ago
June 18, 2026 at 10:50 PM UTC
Fixed (v0.43.0)
5 months ago
June 15, 2026 at 11:26 PM UTC
Last Modified
4 months ago
June 26, 2026 at 01:44 PM UTC