Go/golang.org/x/image CVE-2026-46602: high 7.5, EPSS 0.61%

Lack of limit on tile sizes in x/image/tiff in golang.org/x/image

Action: Upgrade golang.org/x/image to 0.43.0 or later.

go get golang.org/x/image@v0.43.0

Affected

Fixed versions

Sources

• osv: GO-2026-5062
• nvd: CVE-2026-46602
• https://go.dev/cl/788422
• https://go.dev/issue/79905

CVE-2026-46602 · published 2026-06-18T22:50:55Z · modified 2026-06-26T13:44:19.052864027Z · JSON