Uncontrolled Resource Consumption in golang.org/x/image

中危 5.5CVE-2022-41727 · GHSA-qgc7-mgm3-q253 · GO-2023-1572 · Published 28/02/2023 · updated 17/06/2026

要点

CVE-2022-41727 是影响 golang.org/x/image, image (golang) 的中危 (CVSS 5.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.31%，高于 23.4% 的漏洞。
修复：升级到 0.5.0 或更高版本。

Package	Affected versions	Patched versions
golang.org/x/image Go	`< 0.5.0`	`0.5.0`
image golang	`< 0.5.0`	`0.5.0`

Description

An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.

NVD description

An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.

References

golang.org/x/image 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free