CVE-2023-29408: Allocation of Resources Without Limits or Throttling

August 2, 2023 (updated November 7, 2023)

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.

References

go.dev/cl/514897
go.dev/issue/61582
nvd.nist.gov/vuln/detail/CVE-2023-29408
pkg.go.dev/vuln/GO-2023-1989

Code Behaviors & Features

Detect and mitigate CVE-2023-29408 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →