CVE-2026-33809
2 advisories.
Go/golang.org/x/image CVE-2026-33809: medium 5.3, EPSS 0.40%
Go Images vulnerable to an out-of-memory error via a crafted TIFF file
Action: Upgrade golang.org/x/image to 0.38.0 or later.
go get golang.org/x/image@v0.38.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.38.0 | - |
Fixed versions
| 0.38.0 |
Sources
- osv: GHSA-44p7-9xx4-hf2g
- https://nvd.nist.gov/vuln/detail/CVE-2026-33809
- https://cs.opensource.google/go/x/image
- https://go.dev/cl/757660
- https://go.dev/issue/78267
- https://pkg.go.dev/vuln/GO-2026-4815
CVE-2026-33809 · published · modified · JSON
Go/golang.org/x/image CVE-2026-33809: unknown, EPSS 0.40%
OOM from malicious IFD offset in golang.org/x/image/tiff
Action: Upgrade golang.org/x/image to 0.38.0 or later.
go get golang.org/x/image@v0.38.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.38.0 | - |
Fixed versions
| 0.38.0 |
Sources
CVE-2026-33809 · published · modified · JSON