Golang Org X Image Webp
Monthly
Denial of service in the golang.org/x/image/webp decoder (versions before 0.43.0) allows remote attackers to crash any Go application that decodes attacker-supplied WebP images. A malformed VP8 chunk whose declared dimensions differ from the canvas size triggers an unrecovered panic, aborting the goroutine or process. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and SSVC lists exploitation as none, but the flaw is trivially reachable and automatable wherever untrusted images are processed.
Denial of service in Go's x/image/webp library allows remote attackers to crash 32-bit applications by sending specially crafted WEBP images with invalid large size values, triggering runtime panic. Vendor patch released (version 0.39.0) with low EPSS score (0.02%) indicating minimal observed exploitation activity. Despite network vector and no authentication requirements (CVSS AV:N/PR:N), exploitation is platform-specific to 32-bit architectures only.
Denial of service in the golang.org/x/image/webp decoder (versions before 0.43.0) allows remote attackers to crash any Go application that decodes attacker-supplied WebP images. A malformed VP8 chunk whose declared dimensions differ from the canvas size triggers an unrecovered panic, aborting the goroutine or process. No public exploit identified at time of analysis; EPSS is low (0.15%, 5th percentile) and SSVC lists exploitation as none, but the flaw is trivially reachable and automatable wherever untrusted images are processed.
Denial of service in Go's x/image/webp library allows remote attackers to crash 32-bit applications by sending specially crafted WEBP images with invalid large size values, triggering runtime panic. Vendor patch released (version 0.39.0) with low EPSS score (0.02%) indicating minimal observed exploitation activity. Despite network vector and no authentication requirements (CVSS AV:N/PR:N), exploitation is platform-specific to 32-bit architectures only.