Read the docs
TI-2026-34262 Aliases CVE-2026-46603

Excessive memory allocation during VP8L decoding in golang.org/x/image

Priority LOW 39CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-789.

Summary

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Fix Fixed golang.org/x/image/vp8l (golang.org/x/image): 0.45.0Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarygolang.org/x/image/vp8lbefore 0.45.00.45.0Patch availableCNA
  • golang.org/x/image/vp8l VendorGo standard library Affected before 0.45.0 Fixed in 0.45.0 Patch available CNA

Remediation

  • Fix · CNA golang.org/x/image/vp8l (golang.org/x/image) Fixed in 0.45.0

Red Hat 3 advisories

  • RHSA-2026:95360 Released 2026-11-04 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9
  • RHSA-2026:71117 Released 2026-09-23 · Red Hat rating Important
    VolSync v0.16 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/volsync-rhel9
  • RHSA-2026:71116 Released 2026-09-23 · Red Hat rating Important
    VolSync v0.15 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/volsync-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:95360
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:71116
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:71117
Not affected: 3 products
  • Cryostat 4 on RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46603
  2. 2026-11-05 Fix available: Cryostat 4 on RHEL 9 · Red Hat
  3. 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat

References

Other 3

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences