CVE-2026-46599

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46599", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-05-15T17:35:00.813Z", "datePublished": "2026-05-29T19:35:33.539Z", "dateUpdated": "2026-06-01T14:44:03.725Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-29T19:35:33.539Z"}, "title": "Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff", "descriptions": [{"lang": "en", "value": "The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data."}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/tiff", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/image/tiff", "versions": [{"version": "0", "lessThan": "0.41.0", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "unpackBits"}, {"name": "Decode"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "references": [{"url": "https://go.dev/issue/79577"}, {"url": "https://go.dev/cl/759960"}, {"url": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5032"}], "credits": [{"lang": "en", "value": "Uuganbayar Lkhamsuren"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T14:43:59.743802Z", "id": "CVE-2026-46599", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T14:44:03.725Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-46599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T14:43:59.743802Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T14:43:29.816Z"}}], "cna": {"title": "Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff", "credits": [{"lang": "en", "value": "Uuganbayar Lkhamsuren"}], "affected": [{"vendor": "golang.org/x/image", "product": "golang.org/x/image/tiff", "versions": [{"status": "affected", "version": "0", "lessThan": "0.41.0", "versionType": "semver"}], "packageName": "golang.org/x/image/tiff", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "unpackBits"}, {"name": "Decode"}]}], "references": [{"url": "https://go.dev/issue/79577"}, {"url": "https://go.dev/cl/759960"}, {"url": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5032"}], "descriptions": [{"lang": "en", "value": "The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-29T19:35:33.539Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46599", "state": "PUBLISHED", "dateUpdated": "2026-06-01T14:44:03.725Z", "dateReserved": "2026-05-15T17:35:00.813Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-05-29T19:35:33.539Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "golang.org/x/image/tiff", "product": "golang.org/x/image/tiff", "programRoutines": [{"name": "unpackBits"}, {"name": "Decode"}], "vendor": "golang.org/x/image", "versions": [{"lessThan": "0.41.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@golang.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data."}, {"lang": "es", "value": "El decodificador TIFF no impone un l\u00edmite en el tama\u00f1o de los datos comprimidos con PackBits. Una imagen creada maliciosamente puede explotar esto para hacer que una imagen peque\u00f1a (tanto en t\u00e9rminos de ancho/alto de p\u00edxeles como de tama\u00f1o codificado) provoque que el decodificador decodifique grandes cantidades de datos comprimidos."}], "id": "CVE-2026-46599", "lastModified": "2026-07-22T06:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46599", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T14:43:59.743802Z", "version": "2.0.3"}}]}, "published": "2026-05-29T20:16:28.280", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/759960"}, {"source": "security@golang.org", "url": "https://go.dev/issue/79577"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-5032"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.41.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "golang.org/x/image/tiff", "source": "cna", "vendor": "golang.org/x/image"}, "product": "image", "vendor": "golang"}], "created": "2026-05-29T22:30:09.223660+00:00", "updated": "2026-06-01T19:00:14.974363+00:00", "vendors": ["golang", "golang$PRODUCT$image"]}