Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the tiff decoder. An attacker can cause a panic and potentially disrupt service by providing a specially crafted image file with an out-of-bounds strip offset. Remediation Upgrade golang.org/x/image/tiff to versio...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

DEBIAN-CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

UBUNTU-CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

JLSEC-2026-635

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in imagecopyplane...

CVE-2026-46604 Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604

The CVE-2026-46604 entry concerns a panic in the Go TIFF decoder (golang.org/x/image/tiff) when decoding a malformed image containing an out-of-bounds strip offset. Affected component: TIFF decoding path in golang.org/x/image/x/image/tiff. Root cause: decoding invalid TIFF data triggers a panic d...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: grafana-fips, kuma, cloud-provider-aws, minio-fips, coder, skaffold-fips, seaweedfs-rocksdb-fips, osv-scanner, nerdctl, argocd-image-updater-fips, commercial-expanso-edge, cloudbeat, gitlab-rails-ce, zitadel, minio, harbor, kaf, trivy-fips, telegraf, fscrypt,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: gatus-fips, prometheus-podman-exporter, juicefs, grafana-fips, kuma, cloud-provider-aws, minio-fips, coder, skaffold-fips, argo-events-fips, seaweedfs-rocksdb-fips, osv-scanner, nerdctl, argocd-image-updater-fips, nuclei, commercial-expanso-edge,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gatus-fips, prometheus-podman-exporter, juicefs, grafana-fips, tflint-fips, kuma, atlantis, cloud-provider-aws, minio-fips, coder, crossplane-provider-azure-powerbidedicated, skaffold-fips, argo-events-fips, seaweedfs-rocksdb-fips, tflint, tkn, osv-scanner, nerdctl,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: grafana-fips, kuma, cloud-provider-aws, minio-fips, coder, skaffold-fips, seaweedfs-rocksdb-fips, osv-scanner, nerdctl, argocd-image-updater-fips, commercial-expanso-edge, cloudbeat, gitlab-rails-ce, zitadel, minio, harbor, kaf, trivy-fips, telegraf, fscrypt,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: gatus-fips, prometheus-podman-exporter, juicefs, grafana-fips, tflint-fips, kuma, atlantis, cloud-provider-aws, minio-fips, coder, crossplane-provider-azure-powerbidedicated, skaffold-fips, argo-events-fips, seaweedfs-rocksdb-fips, tflint, tkn, osv-scanner, nerdctl,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-efs, kuma, minio-fips, coder, argo-events-fips, crossplane-provider-aws-sns-fips, seaweedfs-rocksdb-fips, crossplane-provider-aws-organizations-fips, nerdctl, flux-operator-fips, crossplane-provider-aws-eks,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: prometheus-podman-exporter, grafana-fips, kuma, cloud-provider-aws, minio-fips, skaffold-fips, argo-events-fips, osv-scanner, nerdctl, argocd-image-updater-fips, nuclei, commercial-expanso-edge, pulumi-language-dotnet, cloudbeat, gomplate, gitlab-rails-ce,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cosign, falco-no-driver, minio, flux, syft, sops, k9s, tekton-chains, k3s, kine, mattermost, loki, age, pulumi-language-java, rancher, buildah, openbao, helm, buildkitd, cloud-provider-aws, mods, istio, argo-cd, telegraf, terraform-provider-azurerm, falcoctl,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: cert-manager, kubernetes-dashboard, prometheus-operator, falco-no-driver, kaf, minio, flux, prometheus, k9s, fscrypt, kubernetes, flux-image-automation-controller, k3s, kine, mattermost, loki, osv-scanner, aactl, cilium-cli, gitea, rancher, snyk-cli, gitlab-kas,...

CVE-2026-46601

A flaw was found in the golang.org/x/image/webp library's WebP decoder. A remote attacker could exploit this vulnerability by providing a specially crafted WebP image containing a VP8 chunk with mismatched dimensions. This could cause the decoder to panic, leading to a denial of service DoS for...

CVE-2026-44696

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text markdown rendering pipeline uses Sanitize::Config::RELAXED:css for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML...