CVE-2026-46599 Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
A malicious TIFF image can cause excessive resource consumption in the Go image library, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46599?
CVE-2026-46599 is a high-severity denial of service vulnerability in golang.org/x/image/tiff, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Weakness: CWE-770
Which versions are affected by CVE-2026-46599?
3 open source packages ship an affected version, including golang.org/x/image.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/image Go | All versions | 0.41.0 |
golang.org/x/image Go | All versions | 0.41.0 |
golang.org/x/image Go | All versions | 0.41.0 |
How do I fix CVE-2026-46599?
Upgrade golang.org/x/image to 0.41.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46599 being exploited?
There is no known exploitation of CVE-2026-46599 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-SN47356, DEBIAN-CVE-2026-46599, GHSA-q675-qj96-32m9, GO-2026-5032, MINI-29xx-qp9j-c9j2, MINI-4rrv-rhmv-p2r8 and 28 more.