Action not permitted
Modal body text goes here.
Modal Title
Modal Body
(CVE-2026-46602)
Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes in ollama 0.32.11-r3
Details
Package ollama version 0.32.11-r3 fixes 11 vulnerabilities: CVE-2026-46602, CVE-2026-33809, CVE-2026-33812, CVE-2026-33813, CVE-2026-46599...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "ollama"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.32.11-r3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.32.11-r3"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package ollama version 0.32.11-r3 fixes 11 vulnerabilities: CVE-2026-46602, CVE-2026-33809, CVE-2026-33812, CVE-2026-33813, CVE-2026-46599...",
"id": "CLEANSTART-2026-YL93188",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-09-01T11:17:16Z",
"references": [
{
"type": "WEB",
"url": "https://ollama.com"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in ollama 0.32.11-r3",
"upstream": [
"CVE-2026-46602",
"CVE-2026-33809",
"CVE-2026-33812",
"CVE-2026-33813",
"CVE-2026-46599",
"CVE-2026-46601",
"CVE-2026-46604",
"CVE-2026-42500",
"CVE-2026-56864",
"CVE-2026-56865",
"ghsa-259r-337f-4rfw"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CVE-2026-33809 (GCVE-0-2026-33809)
Vulnerability from cvelistv5 – Published: 2026-03-25 18:24 – Updated: 2026-04-06 21:12
VLAI
EPSS
VEX
Title
OOM from malicious IFD offset in golang.org/x/image/tiff
Summary
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 20:05 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/tiff |
Affected:
0 , < 0.38.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-33809",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T20:05:32.763729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T20:05:50.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/tiff",
"product": "golang.org/x/image/tiff",
"programRoutines": [
{
"name": "buffer.fill"
},
{
"name": "buffer.ReadAt"
},
{
"name": "Decode"
},
{
"name": "DecodeConfig"
},
{
"name": "buffer.Slice"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.38.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Andy Gill, ZephrSec Ltd"
}
],
"descriptions": [
{
"lang": "en",
"value": "A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T21:12:56.092Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/757660"
},
{
"url": "https://go.dev/issue/78267"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4815"
}
],
"title": "OOM from malicious IFD offset in golang.org/x/image/tiff"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-33809",
"datePublished": "2026-03-25T18:24:04.222Z",
"dateReserved": "2026-03-23T20:35:32.813Z",
"dateUpdated": "2026-04-06T21:12:56.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33812 (GCVE-0-2026-33812)
Vulnerability from cvelistv5 – Published: 2026-04-21 19:21 – Updated: 2026-04-21 20:43
VLAI
EPSS
VEX
Title
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
Summary
Parsing a malicious font file can cause excessive memory allocation.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-21 20:43 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/font/sfnt |
Affected:
0 , < 0.39.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-33812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-21T20:43:08.370574Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T20:43:11.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/font/sfnt",
"product": "golang.org/x/image/font/sfnt",
"programRoutines": [
{
"name": "source.view"
},
{
"name": "Collection.Font"
},
{
"name": "Font.GlyphAdvance"
},
{
"name": "Font.GlyphBounds"
},
{
"name": "Font.GlyphIndex"
},
{
"name": "Font.GlyphName"
},
{
"name": "Font.Kern"
},
{
"name": "Font.LoadGlyph"
},
{
"name": "Font.Name"
},
{
"name": "Font.WriteSourceTo"
},
{
"name": "Parse"
},
{
"name": "ParseCollection"
},
{
"name": "ParseCollectionReaderAt"
},
{
"name": "ParseReaderAt"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.39.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Andy Gill, ZephrSec Ltd"
}
],
"descriptions": [
{
"lang": "en",
"value": "Parsing a malicious font file can cause excessive memory allocation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T19:21:28.556Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/761180"
},
{
"url": "https://go.dev/issue/78382"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4962"
}
],
"title": "Excessive memory allocation when decoding malicious SFNT in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-33812",
"datePublished": "2026-04-21T19:21:28.556Z",
"dateReserved": "2026-03-23T20:35:32.814Z",
"dateUpdated": "2026-04-21T20:43:11.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33813 (GCVE-0-2026-33813)
Vulnerability from cvelistv5 – Published: 2026-04-21 19:21 – Updated: 2026-06-25 19:47
VLAI
EPSS
VEX
Title
Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
Summary
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-22 15:23 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/webp |
Affected:
0 , < 0.42.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-33813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T15:23:43.643284Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T15:34:46.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/webp",
"product": "golang.org/x/image/webp",
"programRoutines": [
{
"name": "decode"
},
{
"name": "Decode"
},
{
"name": "DecodeConfig"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.42.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tristan Madani"
}
],
"descriptions": [
{
"lang": "en",
"value": "Parsing a WEBP image with an invalid, large size panics on 32-bit platforms."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T19:47:15.561Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/759860"
},
{
"url": "https://go.dev/cl/780860"
},
{
"url": "https://go.dev/issue/78407"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4961"
}
],
"title": "Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-33813",
"datePublished": "2026-04-21T19:21:27.644Z",
"dateReserved": "2026-03-23T20:35:32.814Z",
"dateUpdated": "2026-06-25T19:47:15.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42500 (GCVE-0-2026-42500)
Vulnerability from cvelistv5 – Published: 2026-05-29 18:36 – Updated: 2026-05-29 19:51
VLAI
EPSS
VEX
Title
Panic when reading out of bound palette index in golang.org/x/image/bmp
Summary
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-29 19:51 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/bmp |
Affected:
0 , < 0.41.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-29T19:51:07.816824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T19:51:38.147Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/bmp",
"product": "golang.org/x/image/bmp",
"programRoutines": [
{
"name": "decodePaletted"
},
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.41.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T18:36:28.283Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/79576"
},
{
"url": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"
},
{
"url": "https://go.dev/cl/781500"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5031"
}
],
"title": "Panic when reading out of bound palette index in golang.org/x/image/bmp"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-42500",
"datePublished": "2026-05-29T18:36:28.283Z",
"dateReserved": "2026-04-28T00:21:12.791Z",
"dateUpdated": "2026-05-29T19:51:38.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46599 (GCVE-0-2026-46599)
Vulnerability from cvelistv5 – Published: 2026-05-29 19:35 – Updated: 2026-06-01 14:44
VLAI
EPSS
VEX
Title
Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
Summary
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-01 14:43 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/tiff |
Affected:
0 , < 0.41.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T14:43:59.743802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T14:44:03.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/tiff",
"product": "golang.org/x/image/tiff",
"programRoutines": [
{
"name": "unpackBits"
},
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.41.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Uuganbayar Lkhamsuren"
}
],
"descriptions": [
{
"lang": "en",
"value": "The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T19:35:33.539Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/79577"
},
{
"url": "https://go.dev/cl/759960"
},
{
"url": "https://groups.google.com/g/golang-announce/c/uhYX90BlBvI"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5032"
}
],
"title": "Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46599",
"datePublished": "2026-05-29T19:35:33.539Z",
"dateReserved": "2026-05-15T17:35:00.813Z",
"dateUpdated": "2026-06-01T14:44:03.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46601 (GCVE-0-2026-46601)
Vulnerability from cvelistv5 – Published: 2026-06-25 19:47 – Updated: 2026-06-26 16:09
VLAI
EPSS
VEX
Title
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
Summary
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-26 16:08 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/webp |
Affected:
0 , < 0.43.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-26T16:08:56.631719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:09:18.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/webp",
"product": "golang.org/x/image/webp",
"programRoutines": [
{
"name": "decode"
},
{
"name": "Decode"
},
{
"name": "DecodeConfig"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/webp",
"product": "golang.org/x/image/webp",
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Lucas Futures (GitHub: gn00295120)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-125: Out-of-bounds Read",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T19:47:21.500Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/787681"
},
{
"url": "https://go.dev/issue/79869"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5061"
}
],
"title": "Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46601",
"datePublished": "2026-06-25T19:47:21.500Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-06-26T16:09:18.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46602 (GCVE-0-2026-46602)
Vulnerability from cvelistv5 – Published: 2026-06-25 19:47 – Updated: 2026-06-26 16:07
VLAI
EPSS
VEX
Title
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
Summary
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-26 16:05 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/tiff |
Affected:
0 , < 0.43.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-26T16:05:58.046352Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:07:00.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/tiff",
"product": "golang.org/x/image/tiff",
"programRoutines": [
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Prasanna Dabi (GitHub: prasanna8585)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T19:47:21.690Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/788422"
},
{
"url": "https://go.dev/issue/79905"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5062"
}
],
"title": "Lack of limit on tile sizes in x/image/tiff in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46602",
"datePublished": "2026-06-25T19:47:21.690Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-06-26T16:07:00.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46604 (GCVE-0-2026-46604)
Vulnerability from cvelistv5 – Published: 2026-06-26 20:22 – Updated: 2026-06-29 13:20
VLAI
EPSS
VEX
Title
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
Summary
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 13:20 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/tiff |
Affected:
0 , < 0.43.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T13:20:19.539584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T13:20:23.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/tiff",
"product": "golang.org/x/image/tiff",
"programRoutines": [
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "sorte"
}
],
"descriptions": [
{
"lang": "en",
"value": "The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-125: Out-of-bounds Read",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T20:22:46.377Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/788421"
},
{
"url": "https://go.dev/issue/80122"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5066"
}
],
"title": "Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46604",
"datePublished": "2026-06-26T20:22:46.377Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-06-29T13:20:23.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56864 (GCVE-0-2026-56864)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:16
VLAI
EPSS
VEX
Title
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
Summary
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:16 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
|
| golang.org/x/mod | golang.org/x/mod/sumdb |
Affected:
0 , < 0.40.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:16:37.911009Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:16:42.248Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/mod/sumdb",
"product": "golang.org/x/mod/sumdb",
"programRoutines": [
{
"name": "Client.Lookup"
}
],
"vendor": "golang.org/x/mod",
"versions": [
{
"lessThan": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "mundur"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.605Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80745"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://go.dev/cl/815000"
},
{
"url": "https://go.dev/cl/815020"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6180"
}
],
"title": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56864",
"datePublished": "2026-08-13T21:58:53.605Z",
"dateReserved": "2026-06-23T15:10:49.354Z",
"dateUpdated": "2026-08-14T16:16:42.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-56865 (GCVE-0-2026-56865)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:34
VLAI
EPSS
VEX
Title
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Summary
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 15:33 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.25.13
(semver)
Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver) |
|
| golang.org/x/mod | golang.org/x/mod/sumdb/tlog |
Affected:
0 , < 0.40.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-56865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T15:33:28.143873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:34:17.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.6",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.3",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/mod/sumdb/tlog",
"product": "golang.org/x/mod/sumdb/tlog",
"programRoutines": [
{
"name": "tileHashReader.ReadHashes"
}
],
"vendor": "golang.org/x/mod",
"versions": [
{
"lessThan": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Filippo Valsorda (Geomys)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:58:53.475Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/80744"
},
{
"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
},
{
"url": "https://go.dev/cl/814960"
},
{
"url": "https://go.dev/cl/815020"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6179"
}
],
"title": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-56865",
"datePublished": "2026-08-13T21:58:53.475Z",
"dateReserved": "2026-06-23T15:10:49.354Z",
"dateUpdated": "2026-08-14T15:34:17.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…