Executive brief
A vulnerability exists in a Go library used for processing WebP images. If an application uses this library to decode a specially crafted image file, it can cause the application to crash (panic). This could lead to a denial-of-service, where the service becomes unavailable to users.
Technical details
A vulnerability in the golang.org/x/image/webp package allows for a denial-of-service (DoS) via a panic during image decoding. The root cause is a failure to validate that the dimensions within a VP8 chunk match the overall WebP canvas size. When an input contains an ALPH chunk alongside a mismatched VP8 chunk, the decoder constructs an image object with inconsistent internal data. Subsequent attempts to access the alpha channel result in an out-of-bounds memory access, triggering a Go panic. This issue is fixed in version 0.43.0 of the golang.org/x/image library.
Affected products
- Go Project golang.org/x/image/webp < 0.43.0
Timeline
- 2026-06-05: disclosed: Issue reported on GitHub
- 2026-06-18: advisory: Go vulnerability report published
- 2026-06-25: advisory: NVD entry published