CVE-2026-46603

Go/golang.org/x/image CVE-2026-46603: unknown, EPSS 0.41%

Excessive memory allocation during VP8L decoding in golang.org/x/image

Action: Upgrade golang.org/x/image to 0.45.0 or later.

go get golang.org/x/image@v0.45.0

Affected

Fixed versions

Sources

• osv: GO-2026-6222
• https://go.dev/issue/80069
• https://go.dev/cl/793460

CVE-2026-46603 · published 2026-08-14T16:22:50Z · modified 2026-08-15T09:41:53.891904586Z · JSON