Golang Org X Image Vp8L
Monthly
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.
Memory exhaustion via crafted VP8L images affects golang.org/x/image/vp8l in all versions before 0.45.0, enabling remote unauthenticated attackers to crash Go applications that process untrusted image content through this library. The VP8L decoder fails to bound heap allocation when decoding images that declare many unused Huffman tree groups, turning a parsing decision into unconstrained memory growth. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial network attack vector and zero-privilege requirement make this a practical DoS risk for any internet-facing service accepting image uploads.