GitHub Advisoryadvisory · Go

GHSA-44p7-9xx4-hf2g Go Images vulnerable to an out-of-memory error via a crafted TIFF file

MEDIUM Published 2026-03-25 Modified 2026-03-30 Official page ↗
Aliases
CVE-2026-33809
Ecosystem
Go
Packages
golang.org/x/image
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-434, CWE-770
Reviewed
2026-03-30

Affected packages

• Go golang.org/x/image: < 0.38.0 → fixed in 0.38.0

Description

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Related

Alias · CVE (1)

  • CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource… vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References