Memory Exhaustion Vulnerability in VP8L Decoding of Go Programming Language

CVE-2026-46603

What is CVE-2026-46603?

In the Go programming language's VP8L decoding module, improper handling of crafted VP8L images can lead to excessive memory allocation. Attackers leveraging this vulnerability may create malformed images containing numerous unused Huffman tree groups, resulting in memory exhaustion and potential denial of service. This flaw primarily affects versions of Go starting from 1.20, emphasizing the need for timely updates to mitigate the risks associated with this defect.

References