CVE-2026-46599

Summary

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

Severity

high

CVSS

7.5

EPSS

0.4% (p29)

CWE

CWE-770

Also known as

GHSA-q675-qj96-32m9, GO-2026-5032

Published

2026-07-02

Updated

2026-07-02

Advisory details

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

References

• https://github.com/advisories/GHSA-q675-qj96-32m9
• https://nvd.nist.gov/vuln/detail/CVE-2026-46599
• https://go.dev/cl/759960
• https://go.dev/issue/79577
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
• https://pkg.go.dev/vuln/GO-2026-5032

Related advisories

• CVE-2026-42500 — medium · Go/golang.org/x/image
• CVE-2026-33812 — medium · Go/golang.org/x/image
• CVE-2026-33813 — medium · Go/golang.org/x/image
• CVE-2026-33809 — medium · Go/golang.org/x/image
• CVE-2026-59873 — critical · npm/tar
• CVE-2026-87011 — high · PyPI/open-webui
• CVE-2026-86075 — high · npm/n8n
• CVE-2026-59161 — high · Go/github.com/xuri/excelize/v2

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity