- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 13 · 7 high, 3 medium
- Registry
- pkg.go.dev
Advisories 13
- CVE-2026-46603High 7.5
Excessive memory allocation during VP8L decoding in golang.org/x/image
Affected: fixed in 0.45.0.
- CVE-2026-46604High 7.5
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
Affected: fixed in 0.43.0.
- CVE-2026-46602High 7.5
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
Affected: fixed in 0.43.0.
- CVE-2026-46601High 7.5
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
Affected: fixed in 0.43.0.
- CVE-2026-46599High 7.5
Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
Affected: fixed in 0.41.0.
- CVE-2026-42500Medium 5.3
Panic when reading out of bound palette index in golang.org/x/image/bmp
Affected: fixed in 0.41.0.
- CVE-2026-33812Medium 6.1
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
Affected: fixed in 0.39.0.
- CVE-2026-33813High 7.5
Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
Affected: fixed in 0.42.0.
- CVE-2026-33809Medium 5.3
OOM from malicious IFD offset in golang.org/x/image/tiff
Affected: fixed in 0.38.0.
- CVE-2024-24792High 7.5
Panic when parsing invalid palette-color images in golang.org/x/image
Affected: fixed in 0.18.0.
- CVE-2023-29407Unrated
Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
Affected: fixed in 0.10.0.
- CVE-2023-29408Unrated
Excessive resource consumption in golang.org/x/image/tiff
Affected: fixed in 0.10.0.
- CVE-2022-41727Unrated
Denial of service via crafted TIFF image in golang.org/x/image/tiff
Affected: fixed in 0.5.0.