—
GO-2026-4962
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
Quick fix
GO-2026-4962 — golang.org/x/image: upgrade to the fixed version with the command below.
go get golang.org/x/image@v0.39.0Details
Parsing a malicious font file can cause excessive memory allocation.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://go.dev/cl/761180[FIX]
- https://go.dev/issue/78382[REPORT]