CVE-2026-33813

Go/golang.org/x/image CVE-2026-33813: unknown, EPSS 0.62%

Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image

Action: Upgrade golang.org/x/image to 0.42.0 or later.

go get golang.org/x/image@v0.42.0

Affected

Fixed versions

Sources

• osv: GO-2026-4961
• https://go.dev/cl/759860
• https://go.dev/cl/780860
• https://go.dev/issue/78407

CVE-2026-33813 · published 2026-04-21T18:59:43Z · modified 2026-06-25T18:45:14.933531136Z · JSON