Vulnerability Report: GO-2026-5061

  • CVE-2026-46601
  • Affects: golang.org/x/image
  • Published: Jun 18, 2026

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

Affected Packages

Aliases

References

Credits

  • Lucas Futures (GitHub: gn00295120)

Feedback

See anything missing or incorrect? Suggest an edit to this report.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.