CVE-2026-46603

Aliases:GO-2026-6222DEBIAN-CVE-2026-46603UBUNTU-CVE-2026-46603CGA-2c7j-gmm4-vr75CGA-2chm-69j8-3vg6CGA-3wqw-h35w-j8r2CGA-4964-x86q-vr9vCGA-5g3p-qc6w-72jcCGA-8frf-6hgg-hxp7CGA-8rf8-vfw7-ggc5CGA-97x5-fgq5-mchhCGA-98fj-2qr8-2whmCGA-98wp-j45h-5pq3CGA-cfvf-63c8-6959CGA-f26h-w6f3-vcw8CGA-f48g-gx7h-5qfjCGA-f4jj-frpf-9wpwCGA-fj4j-rc5v-c2jgCGA-fmmp-c8gv-jg3fCGA-fvrm-v45j-j5mjCGA-g4g9-crq7-q67cCGA-g737-v5h8-h6mwCGA-gqmp-7mv2-r53cCGA-h864-ggp8-rrxgCGA-hhh8-hrhc-2496CGA-hmxc-xcm6-p3j3CGA-hwh8-qfp3-2mjqCGA-j3qh-hwmv-xrjcCGA-jjqw-5j3w-7hwvCGA-m8r5-pvcw-8mx3CGA-mfrm-wfhm-83w5CGA-mrw5-rccv-878pCGA-pvjg-2hxp-j2hmCGA-2745-3wx4-c443CGA-2h54-79w5-pc3qCGA-2hqc-pc7g-2xwrCGA-2w2j-695j-v9pjCGA-32fg-m9p2-2p4vCGA-345p-8p8c-8rvcCGA-35xx-rqc8-6xcfCGA-36cp-x8jc-3gx7CGA-3752-hc54-mf8qCGA-3752-xv7f-4g67CGA-3fjh-c2p7-7vgpCGA-3g3w-m373-g2qpCGA-3vg2-r297-qjvjCGA-3w58-w856-3vcvCGA-47fx-q26j-qfcvCGA-48fq-57qr-qqxqCGA-4cmx-222x-38g2CGA-4hp3-r49w-xg94CGA-4hpx-j3mm-v9wxCGA-4jpg-98f3-h554CGA-4jwh-59rp-m476CGA-4vv7-vcvg-h37mCGA-4x7w-fg7j-x959CGA-524w-j77h-3x4pCGA-559g-g7fg-pghhCGA-5696-w94r-mg68CGA-56gg-9r22-8rp7CGA-5m64-hwxf-g96gCGA-5mm4-p7q9-9jwgCGA-5r4p-xvgc-879wCGA-5r7p-7p8x-wrm7CGA-5x7f-2967-fvv5CGA-63vq-g7f6-gxh3CGA-65fm-3x66-7779CGA-65vr-7v2g-jg6qCGA-673g-xc2h-r6qrCGA-6c3h-c63m-3fxmCGA-6h64-pj96-vmhmCGA-6hxw-2wh4-jpwjCGA-6j5c-4jhg-jr2mCGA-6wx3-9g89-943cCGA-72rj-v6qp-945vCGA-754p-cvg5-jjf3CGA-784c-64qg-c2pwCGA-7fx6-23jw-43pqCGA-7m5m-3p2m-98ffCGA-7prq-cwj2-mgc4CGA-7vp8-947g-hj2hCGA-8767-mph7-wfhqCGA-88h6-pgc4-fx5cCGA-8999-427c-vfpvCGA-8cxc-h24p-974cCGA-8fhp-jpxp-q9qfCGA-8fjp-prq9-hgwmCGA-8fpm-x835-p66fCGA-922q-jj7h-9r85CGA-93h5-564g-56q9CGA-99c9-xg6w-wr9mCGA-9g2f-rph7-vpq5CGA-9grx-5wv6-8587CGA-9jpw-c77v-59j9CGA-c34c-fxqh-x9j8CGA-c3cf-6cv4-jx8vCGA-c42m-6wch-6xg8CGA-c4j7-7j87-xxwfCGA-c6p2-7xpj-6fhcCGA-c829-m6gh-835wCGA-c8qh-rh3m-m75wCGA-c9rg-5m9j-cwrfCGA-cfr8-3w3g-23v9CGA-cg53-64v6-gqv8CGA-ch7q-5phx-7753CGA-chw4-w538-rw93CGA-cpxx-jx28-mp7rCGA-crhq-38x3-hx7qCGA-cvvp-jw49-296gCGA-cw77-g47c-25x7CGA-cx52-qxcc-xjmhCGA-f4fv-x2f3-223vCGA-f66w-2qfp-6qh7CGA-f93c-w63h-gc95CGA-f998-v5f6-cjpgCGA-fjjp-jfr4-8hp5CGA-fmg5-69r6-5xj3CGA-fq5x-cpm4-ghprCGA-fv34-9cg5-xmxcCGA-fxwp-j6r2-4hrcCGA-g6h5-2gh6-8p22CGA-g7v3-4pqm-4q5jCGA-g8q2-5gwx-4vrjCGA-gfgh-f6vq-6p8mCGA-gmgq-46mm-4wrvCGA-gr5f-5fhj-x39fCGA-gr9g-fmwg-x4mxCGA-grwh-v7h2-c6h2CGA-h52g-p2m9-pgjwCGA-h537-2j2v-fvm9CGA-h862-pjwq-g86jCGA-h969-pv8v-rf73CGA-hc79-8vcp-42jhCGA-hf3c-26ww-75fvCGA-hhgr-fxqg-26v8CGA-j5pw-xw26-5q47CGA-j5wm-frvx-jr4vCGA-jcmq-jx37-mxfwCGA-jcx3-674v-h6frCGA-jf7x-46f8-4jmvCGA-jjgm-98g8-c3rqCGA-jm8r-6qfp-jx62CGA-jp43-m73j-vrvxCGA-jr28-x3gh-399fCGA-jwfp-75x4-jjcmCGA-jx56-qvw5-fvphCGA-m34c-7hp5-wf5cCGA-m6r2-mcxp-r8rgCGA-m733-fj3v-cgp9CGA-mfmp-qfr4-57mqCGA-mmh6-255f-r2wqCGA-mpr7-3rgq-28fwCGA-mqvg-rr36-wjq6CGA-mr9w-q6qq-3238CGA-p69m-rfg9-695hCGA-p96x-9rx3-pfx8CGA-pjf3-cmx9-c63cCGA-pmc4-3778-wp7fCGA-pr77-v8gx-x4qxCGA-q32v-r27w-65jgCGA-q36g-gqhm-cpj8CGA-q66c-8qjw-hw8cCGA-qg74-j95x-f5xfCGA-qggh-5cph-53j4CGA-qghq-6f44-3xgfCGA-qrc3-pp27-mmj4CGA-qvqw-2jh2-6q2rCGA-qw9j-947g-2wp4CGA-qx6h-5g2j-85vcCGA-r3hh-6g8m-x5g3CGA-r4cp-mh95-vvfrCGA-r9gr-g5mh-h539CGA-rj3w-4ffj-7h43CGA-rjmv-r3hx-fqqqCGA-rm9q-7mj9-3h9cCGA-rmpg-frv5-w76jCGA-v4gg-f3w7-3hv4CGA-v4m9-pvfx-j3xqCGA-v7ff-vxm3-88vrCGA-vcrp-pf43-mmrwCGA-vg26-m6p7-g948CGA-vh72-qc2c-8qj7CGA-vm35-q4v3-cf66CGA-vpc9-m838-28fpCGA-vpqf-373h-4fxqCGA-vrmj-7hxx-mxhfCGA-vvmj-j42g-m9whCGA-vvqp-q2c4-g9pxCGA-vwm5-82cg-wjf7CGA-vwrq-6c24-8vj9CGA-w3gh-8rpm-c3xwCGA-w3gq-2pvg-2pccCGA-w6fr-pmwh-wv96CGA-w72g-x58p-42qhCGA-w8cv-7rmw-8969CGA-wpqq-x566-j9x4CGA-x79f-5cxh-hrf2CGA-x7p4-p57j-rmcwCGA-xf2h-4ccq-4vffCGA-xh3v-r75w-2cf7CGA-xmfq-m3rm-68pvCGA-47fq-p2cc-479fCGA-69jg-99cx-gwcjCGA-9m8v-w465-7h3fCGA-chpr-rhw5-cfmjCGA-fjq2-r2qw-99hhCGA-5whh-4h73-5pwfCGA-7m8h-7c8p-pj8mCGA-8jqj-mhwh-74m8CGA-xh79-h9mf-8c87
Advisory lineage Upstream: 0 Downstream: 2
Awaiting Analysis
Published: 14 Aug 2026, 16:38
Last modified:14 Aug 2026, 19:36

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.42% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Aug 2026, 16:38
Published
Vulnerability first disclosed
14 Aug 2026, 19:36
Last Modified
Vulnerability information updated

Description

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.42%• Percentile: 36%

Techniques & Countermeasures

  • CWE-789•Memory Allocation with Excessive Size Value

    The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected Systems

  • chainguard•bento

    < 1.20.0-r2

  • chainguard•bento-fips

    < 1.20.0-r2

  • chainguard•cg

    < 0

  • chainguard•chainctl

    < 0

  • chainguard•chainctl-fips

    < 0

  • chainguard•commercial-chainloop-backend

    all

  • chainguard•commercial-gitlab-workhorse-ee-19.2

    all

  • chainguard•commercial-gitlab-workhorse-ee-19.3

    all

  • chainguard•commercial-gitlab-workhorse-ee-fips-19.2

    all

  • chainguard•commercial-gitlab-workhorse-ee-fips-19.3

    all

  • chainguard•filebrowser

    < 0

  • chainguard•fortio

    < 1.75.2-r5

  • chainguard•fortio-fips

    < 1.75.2-r4

  • chainguard•gatus

    < 0

  • chainguard•gatus-fips

    < 0

  • chainguard•gitea

    < 1.27.2-r1

  • chainguard•gitea-fips

    < 1.27.2-r1

  • chainguard•gitlab-workhorse-ce-18.10

    < 0

  • chainguard•gitlab-workhorse-ce-18.11

    < 0

  • chainguard•gitlab-workhorse-ce-18.6

    < 0

  • chainguard•gitlab-workhorse-ce-18.7

    < 0

  • chainguard•gitlab-workhorse-ce-18.8

    < 0

  • chainguard•gitlab-workhorse-ce-18.9

    < 0

  • chainguard•gitlab-workhorse-ce-19.0

    < 0

  • chainguard•gitlab-workhorse-ce-19.1

    < 0

  • chainguard•gitlab-workhorse-ce-19.2

    < 0

  • chainguard•gitlab-workhorse-ce-19.3

    < 0

  • chainguard•gitlab-workhorse-ce-fips-18.10

    < 0

  • chainguard•gitlab-workhorse-ce-fips-18.11

    < 0

  • chainguard•gitlab-workhorse-ce-fips-18.6

    < 0

  • chainguard•gitlab-workhorse-ce-fips-18.7

    < 0

  • chainguard•gitlab-workhorse-ce-fips-18.8

    < 0

  • chainguard•gitlab-workhorse-ce-fips-18.9

    < 0

  • chainguard•gitlab-workhorse-ce-fips-19.0

    < 0

  • chainguard•gitlab-workhorse-ce-fips-19.1

    < 0

  • chainguard•gitlab-workhorse-ce-fips-19.2

    < 0

  • chainguard•gitlab-workhorse-ce-fips-19.3

    < 0

  • chainguard•glab

    < 0

  • chainguard•glab-fips

    < 0

  • chainguard•hugo

    < 0

  • chainguard•hugo-extended

    < 0

  • chainguard•hugo-fips

    < 0

  • chainguard•kitty

    < 0.48.2-r2

  • chainguard•kubescape

    < 4.0.12-r2

  • chainguard•kubescape-server

    < 4.0.12-r2

  • chainguard•kubescape-server-downloader

    < 4.0.12-r2

  • chainguard•kubescape-server-fips

    < 4.0.12-r2

  • chainguard•kubescape-server-fips-downloader

    < 4.0.12-r2

  • chainguard•listmonk

    < 0

  • chainguard•mailpit

    < 1.30.7-r2

Showing first 50 affected entries in server-rendered view.

References (7)