—

GO-2026-6222

Excessive memory allocation during VP8L decoding in golang.org/x/image

Quick fix

GO-2026-6222 — golang.org/x/image: upgrade to the fixed version with the command below.

go get golang.org/x/image@v0.45.0

Details

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / golang.org/x/image

Introduced in: 0 Fixed in: 0.45.0

Fix go get golang.org/x/image@v0.45.0

References

https://go.dev/issue/80069 [REPORT]
https://go.dev/cl/793460 [FIX]