Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2023-29408

Excessive resource consumption in golang.org/x/image/tiff

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/image golang.org/x/image/tiff

Default version status: unaffected

  • 0 to < 0.10.0affected

References