EUVD-2026-58720Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no authentication or interaction needed; impact is solely availability loss via OOM, with no confidentiality or integrity exposure.
Primary rating from Vendor (Go).
CVSS VectorVendor: Go
Lifecycle Timeline
5DescriptionCVE.org
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
AnalysisAI
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
Technical ContextAI
VP8L is the lossless compression format underlying WebP images; it employs Huffman coding with configurable tree groups to compress pixel data. The golang.org/x/image/vp8l package (CPE: cpe:2.3:a:golang.org/x/image:golang.org/x/image/vp8l) is a supplemental Go image library outside the standard library, used by Go applications needing extended image format support. CWE-789 (Uncontrolled Memory Allocation) is the root cause: the decoder allocates Huffman tree group structures proportional to the count encoded in the image header without validating whether those groups are actually referenced during decoding. A specially crafted image can specify an arbitrarily large number of unused tree groups, forcing allocation of gigabytes of heap memory before any content is decoded. This is a parse-time vulnerability, not a decode-time one, meaning the OOM occurs before pixel data is processed.
RemediationAI
Upgrade golang.org/x/image to version 0.45.0 or later, which contains the fix introduced in CL 793460 (https://go.dev/cl/793460). In go.mod, update the require directive to require golang.org/x/image v0.45.0 and run go mod tidy. The vendor advisory and vulnerability record are at https://pkg.go.dev/vuln/GO-2026-6222. If an immediate upgrade is not feasible, the primary compensating control is to validate image format and file size at the ingress layer before passing data to the vp8l decoder - for example, reject files exceeding a conservative size threshold or restrict accepted MIME types to exclude WebP/VP8L. Note that size-based filtering alone may not fully prevent exploitation if the Huffman group count is encoded early in a small file header; structural validation or removal of VP8L processing capabilities is a stronger interim measure.
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today