CVE-2026-46603 - Vulnerability Details - OpenCVE

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Golang	Image

No data.

No data.

References

Link	Providers
https://go.dev/cl/793460
https://go.dev/issue/80069
https://pkg.go.dev/vuln/GO-2026-6222

History

Mon, 17 Aug 2026 11:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Golang Golang image
Vendors & Products		Golang Golang image

Fri, 14 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-400

Fri, 14 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 14 Aug 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400 CWE-789

Fri, 14 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
Title		Excessive memory allocation during VP8L decoding in golang.org/x/image
References		https://go.dev/cl/793460 https://go.dev/issue/80069 https://pkg.go.dev/vuln/GO-2026-6222

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-08-14T16:38:16.879Z

Updated: 2026-08-14T19:36:57.436Z

Reserved: 2026-05-15T17:35:00.814Z

Link: CVE-2026-46603

Vulnrichment

Updated: 2026-08-14T19:36:50.887Z

NVD

Status : Awaiting Analysis

Published: 2026-08-14T17:18:15.307

Modified: 2026-09-03T16:37:52.170

Link: CVE-2026-46603

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46603", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-05-15T17:35:00.814Z", "datePublished": "2026-08-14T16:38:16.879Z", "dateUpdated": "2026-08-14T19:36:57.436Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-08-14T16:38:16.879Z"}, "title": "Excessive memory allocation during VP8L decoding in golang.org/x/image", "descriptions": [{"lang": "en", "value": "VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion."}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/vp8l", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/image/vp8l", "versions": [{"version": "0", "lessThan": "0.45.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "decoder.decodeHuffmanGroups"}, {"name": "decoder.decodeHuffmanTree"}, {"name": "Decode"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "references": [{"url": "https://go.dev/issue/80069"}, {"url": "https://go.dev/cl/793460"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6222"}], "credits": [{"lang": "en", "value": "Daniele Ballarini"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-789", "lang": "en", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T19:36:26.966791Z", "id": "CVE-2026-46603", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:36:57.436Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46603", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T19:36:26.966791Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:36:50.887Z"}}], "cna": {"title": "Excessive memory allocation during VP8L decoding in golang.org/x/image", "credits": [{"lang": "en", "value": "Daniele Ballarini"}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/vp8l", "versions": [{"status": "affected", "version": "0", "lessThan": "0.45.0", "versionType": "semver"}], "packageName": "golang.org/x/image/vp8l", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "decoder.decodeHuffmanGroups"}, {"name": "decoder.decodeHuffmanTree"}, {"name": "Decode"}]}], "references": [{"url": "https://go.dev/issue/80069"}, {"url": "https://go.dev/cl/793460"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6222"}], "descriptions": [{"lang": "en", "value": "VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-08-14T16:38:16.879Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46603", "state": "PUBLISHED", "dateUpdated": "2026-08-14T19:36:57.436Z", "dateReserved": "2026-05-15T17:35:00.814Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-08-14T16:38:16.879Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}