{"id":"CVE-2026-46599","title":"golang.org/x/image/tiff has excessive resource consumption in PackBits decompression","summary":"golang.org/x/image/tiff has excessive resource consumption in PackBits decompression","severity":"high","cvss":7.5,"cwe":["CWE-770"],"vendor":"x","product":"golang.org/x/image","ecosystem":"go","affected":["golang.org/x/image < 0.41.0"],"patched":["golang.org/x/image 0.41.0"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-q675-qj96-32m9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46599"},{"url":"https://go.dev/cl/759960"},{"url":"https://go.dev/issue/79577"},{"url":"https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"},{"url":"https://pkg.go.dev/vuln/GO-2026-5032"},{"url":"https://github.com/advisories/GHSA-q675-qj96-32m9"}],"tags":["ghsa","go"],"epss":0.00353,"epssPercentile":0.29057,"ingestedAt":"2026-07-02T21:44:45.082Z","slug":"CVE-2026-46599","body":"## Overview\n\nThe TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.\n\n## Affected packages\n\n- `golang.org/x/image < 0.41.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/image 0.41.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}