CVE-2026-46603: Golang.org/x/image golang.org/x/image/vp8l

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

Affected products

• Golang.org/x/image golang.org/x/image/vp8l: before 0.45.0 (fixed in 0.45.0)

Published 2026-08-14. Last modified 2026-09-03.