Go Images vulnerable to an out-of-memory error via a crafted TIFF file

MÉDIO 5.3CVE-2026-33809 · GHSA-44p7-9xx4-hf2g · GO-2026-4815 · Published 25/03/2026 · updated 17/06/2026

Em resumo

CVE-2026-33809 é uma vulnerabilidade MÉDIO (CVSS 5.3) que afeta golang.org/x/image, tiff (golang).
Chance de exploração nos próximos 30 dias (EPSS): 0.33%, maior que 26.8% das vulnerabilidades.
Correção: atualize para 0.38.0 ou posterior.

Package	Affected versions	Patched versions
golang.org/x/image Go	`< 0.38.0`	`0.38.0`
tiff golang	`< 0.38.0`	`0.38.0`

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

NVD description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

References

nvd.nist.gov/vuln/detail/CVE-2026-33809 · ADVISORY
cs.opensource.google/go/x/image · PACKAGE
go.dev/cl/757660 · WEB
go.dev/issue/78267 · WEB
pkg.go.dev/vuln/GO-2026-4815 · WEB

Mais vulnerabilidades de golang.org/x/image

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

golang.org/x/image

< 0.38.0

0.38.0

tiff

golang

< 0.38.0

0.38.0

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

NVD description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Mais vulnerabilidades de golang.org/x/image

Ver tudo →