CVE-2026-46599: golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

July 2, 2026

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

References

github.com/advisories/GHSA-q675-qj96-32m9
go.dev/cl/759960
go.dev/issue/79577
groups.google.com/g/golang-announce/c/uhYX90BlBvI
nvd.nist.gov/vuln/detail/CVE-2026-46599
pkg.go.dev/vuln/GO-2026-5032

Code Behaviors & Features

Detect and mitigate CVE-2026-46599 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →