GitHub Advisoryadvisory · Go

GHSA-q7rw-w4cq-2j6w bep/imagemeta allows excessively large EXIF data structures

MEDIUM Published 2025-04-09 Modified 2025-04-09 Official page ↗
Aliases
CVE-2025-32024
Ecosystem
Go
Packages
github.com/bep/imagemeta
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2025-04-09

Affected packages

• Go github.com/bep/imagemeta: < 0.10.0 → fixed in 0.10.0

Description

Impact The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before `v0.10.0`, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. Patches `v0.10.0` added LimitNumTags (default 5000) and LimitTagSize (default 10000) options.

Related

Alias · CVE (1)

  • CVE-2025-32024 bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References