Quick answers
- Is CVE-2026-46601 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46601 being exploited in the wild.
- How severe is CVE-2026-46601?
- Informational severity, with a CVSS score of 0, published 25 June 2026.
- Which products and versions are affected?
- golang.org/x/image (Go) SEMVER:introduced=0,fixed=0.43.0.
- Is there a fix for CVE-2026-46601?
- Yes. golang.org/x/image (Go): upgrade to 0.43.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-46601 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-46601?
- Check whether you run golang.org/x/image (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- golang.org/x/image (Go): upgrade to 0.43.0 or later
go get golang.org/x/image@v0.43.0
Technical details
A vulnerability in the golang.org/x/image/webp package allows for a denial-of-service (DoS) via a panic during image decoding. The root cause is a failure to validate that the dimensions within a VP8 chunk match the overall WebP canvas size. When an input contains an ALPH chunk alongside a mismatched VP8 chunk, the decoder constructs an image object with inconsistent internal data. Subsequent attempts to access the alpha channel result in an out-of-bounds memory access, triggering a Go panic. This issue is fixed in version 0.43.0 of the golang.org/x/image library.
Affected products
- Go Project golang.org/x/image/webp < 0.43.0
Identifiers
- CVE-2026-46601
- GO-2026-5061
Timeline
- 2026-06-05: disclosed: Issue reported on GitHub
- 2026-06-18: advisory: Go vulnerability report published
- 2026-06-25: advisory: NVD entry published