# CVE-2026-46599: Go x/image/tiff resource exhaustion in PackBits decompression

Source: https://junglewise.ai/threats/cve-2026-46599-go-x-image-tiff-resource-exhaustion-in-packbits-decompression  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-46599 · Severity: high · CVSS 7.5 · Published 2026-05-29

A vulnerability in the Go TIFF image decoding library could allow an attacker to crash an application or cause a denial-of-service. By providing a specially crafted, small image file, an attacker can force the system to consume excessive processing power and memory during decompression. This can lead to service outages or significant performance degradation for any application that processes user-uploaded TIFF images.

Technologies: [golang.org/x/image (Go)](https://junglewise.ai/threats/technologies/golang-org-x-image). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-46599 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46599 being exploited in the wild.

**How severe is CVE-2026-46599?** High severity, with a CVSS score of 7.5, published 29 May 2026.

**Which products and versions are affected?** golang.org/x/image (Go) < 0.41.0, SEMVER:introduced=0,fixed=0.41.0; tiff (Go) before v0.41.0.

**Is there a fix for CVE-2026-46599?** Yes. golang.org/x/image (Go): upgrade to 0.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46599 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46599?** Check whether you run golang.org/x/image (Go) or tiff (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/image (Go): upgrade to 0.41.0 or later

  ```sh
  go get golang.org/x/image@v0.41.0
  ```


## Technical details

A resource exhaustion vulnerability exists in the golang.org/x/image/tiff package due to a lack of size limits on PackBits-compressed data. The 'unpackBits' and 'Decode' functions in the TIFF decoder do not validate the ratio of compressed to decompressed data, allowing a small input file to expand into a massive amount of data in memory. An unauthenticated remote attacker can exploit this by submitting a specially crafted TIFF image to an application using the library, leading to a denial-of-service (DoS) via CPU and memory exhaustion. The issue is addressed in version 0.41.0 by implementing limits on the amount of PackBits-compressed data the decoder will process.

## Affected products

- Go golang.org/x/image/tiff < 0.41.0

## Identifiers

- CVE-2026-46599
- GHSA-q675-qj96-32m9
- GO-2026-5032

## Timeline

- 2026-05-21: disclosed: Issue reported to Go project by Uuganbayar Lkhamsuren
- 2026-05-29: advisory: NVD published CVE-2026-46599
- 2026-07-02: patched: GitHub Advisory published and version 0.41.0 released

## References

- [https://go.dev/cl/759960](https://go.dev/cl/759960)
- [https://go.dev/issue/79577](https://go.dev/issue/79577)
- [https://groups.google.com/g/golang-announce/c/uhYX90BlBvI](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI)
- [https://pkg.go.dev/vuln/GO-2026-5032](https://pkg.go.dev/vuln/GO-2026-5032)

## Related threats

- [GO-2026-6222 - Excessive memory allocation during VP8L decoding in golang.org/x/image](https://junglewise.ai/threats/cve-2026-46603-go-2026-6222-excessive-memory-allocation-during-vp8l-decoding-in)
- [Go x/image/tiff denial of service via out-of-bounds strip offset](https://junglewise.ai/threats/cve-2026-46604-go-x-image-tiff-denial-of-service-via-out-of-bounds-strip-offset)
- [Go x/image/tiff unbounded memory consumption in TIFF decoder](https://junglewise.ai/threats/cve-2026-46602-go-x-image-tiff-unbounded-memory-consumption-in-tiff-decoder)
- [Go x/image/webp denial of service via mismatched VP8 dimensions](https://junglewise.ai/threats/cve-2026-46601-go-x-image-webp-denial-of-service-via-mismatched-vp8-dimensions)
- [Go x/image panic in BMP decoder](https://junglewise.ai/threats/cve-2026-42500-go-x-image-panic-in-bmp-decoder)