CVE-2026-46603: Excessive memory allocation during VP8L decoding in golang.org/x/image

Published Aug 14, 2026

Updated

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

Affected Software

1 affected component

golang.org/x/image/vp8l=

Event History

Aug 14, 2026

CVE Published

via MITRE·04:38 PM

Data Sourced

via MITRE·04:38 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-46603?

CVE-2026-46603 has a risk rating of 37, indicating a moderate severity level.

How do I fix CVE-2026-46603?

To mitigate CVE-2026-46603, update golang.org/x/image/vp8l to a version that addresses this excessive memory allocation issue.

What type of vulnerability is CVE-2026-46603?

CVE-2026-46603 is a denial of service vulnerability due to excessive memory allocation during VP8L decoding.

Who can exploit CVE-2026-46603?

A remote attacker can exploit CVE-2026-46603 by sending a crafted VP8L image to trigger memory exhaustion.

What impact does CVE-2026-46603 have on systems?

CVE-2026-46603 can lead to a denial of service, potentially causing affected systems to become unresponsive due to memory exhaustion.