CVE-2026-46603 — Excessive memory allocation during VP8L decoding in golang.org/x/image
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows …
Published: 2026-08-14 · CVSS: 7.5 · CVSS 3.1
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7