CVE-2026-46601

Go/golang.org/x/image CVE-2026-46601: unknown, EPSS 0.61%

Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image

Action: Upgrade golang.org/x/image to 0.43.0 or later.

go get golang.org/x/image@v0.43.0

Affected

Fixed versions

Sources

• osv: GO-2026-5061
• https://go.dev/cl/787681
• https://go.dev/issue/79869

CVE-2026-46601 · published 2026-06-18T22:46:58Z · modified 2026-06-26T13:44:18.873843227Z · JSON