CVE-2026-33813 json
Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
published 2026-04-21 6 mo ago modified 2026-10-26 13 d ago also GO-2026-4961 , EUVD-2026-24247
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Patch / fix
- go golang.org/x/image 0.42.0
- golang.org/x/image golang.org/x/image/webp 0.42.0
- golang-golang-x-image Debian 14 0.39.0-1
debian advisories DEBIAN-CVE-2026-33813
- golang1.25 hummingbird 1 1.25.9-1.hum1
- golang1.25-bin hummingbird 1 1.25.9-1.hum1
- golang1.25-src hummingbird 1 1.25.9-1.hum1
- golang1.25-misc hummingbird 1 1.25.9-1.hum1
- golang1.25-tests hummingbird 1 1.25.9-1.hum1
- golang1.25-shared hummingbird 1 1.25.9-1.hum1
- golang1.26 hummingbird 1 1.26.2-1.1.hum1
- golang1.26-bin hummingbird 1 1.26.2-1.1.hum1
red hat advisories RHSA-2026:7385RHSA-2026:8291
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- rclone openSUSE Leap 16.0 1.74.4-bp160.1.1
- rclone openSUSE Tumbleweed 1.74.0-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21436-1openSUSE-SU-2026:10682-1
- rclone Alpine 3.24 1.74.0-r0
alpine advisories ALPINE-CVE-2026-33813
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- go.dev/cl/759860 patch
- go.dev/cl/780860 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-33813 updated cvss 6.5
golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing
-
Red Hat OpenShift Serverless openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9affected: no fix available
-
Red Hat Enterprise Linux 8 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 moreaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux AI (RHEL AI) 3 golang Red Hat OpenShift Container Platform 4 ossm-2/openshift-golang-builder-containeraffected: no fix available
-
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-storage-rhel9 4.2.0-13fixed: vendor fix RHSA-2026:17789
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.4 openshift-logging/cluster-logging-rhel9-operator 1782412815fixed: vendor fix RHSA-2026:34364
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/cluster-logging-rhel9-operator 1786658378fixed: vendor fix RHSA-2026:56340
-
Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779579439fixed: vendor fix RHSA-2026:22347
-
Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1778867753fixed: vendor fix RHSA-2026:21769
show 13 moreshow fewer
-
Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1780167118fixed: vendor fix RHSA-2026:23345
-
Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779925273fixed: vendor fix RHSA-2026:24503
-
Red Hat Hardened Images golang1.25 1.25.9-1.hum1, golang1.26 1.26.2-1.1.hum1, golang1.25-bin 1.25.9-1.hum1, golang1.25-src 1.25.9-1.hum1, golang1.25-misc 1.25.9-1.hum1, golang1.25-tests 1.25.9-1.hum1, +6 morefixed: vendor fix RHSA-2026:7385
-
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-9, cryostat/cryostat-db-rhel9 4.2.0-13, cryostat/jfr-datasource-rhel9 4.2.0-9, cryostat/cryostat-reports-rhel9 4.2.0-9, cryostat/cryostat-operator-bundle 4.2.0-7, cryostat/cryostat-rhel9-operator 4.2.0-13, +3 more Red Hat Logging Subsystem for Red Hat OpenShift 6.4 openshift-logging/vector-rhel9 1782393583, openshift-logging/eventrouter-rhel9 1782408807, openshift-logging/logging-loki-rhel9 1782405469, openshift-logging/loki-rhel9-operator 1782464542, openshift-logging/opa-openshift-rhel9 1782392937, openshift-logging/loki-operator-bundle 1782465285, +3 more Red Hat Logging Subsystem for Red Hat OpenShift 6.5 openshift-logging/vector-rhel9 1786645392, openshift-logging/eventrouter-rhel9 1786645107, openshift-logging/logging-loki-rhel9 1786645248, openshift-logging/loki-rhel9-operator 1786645138, openshift-logging/opa-openshift-rhel9 1786645109, openshift-logging/loki-operator-bundle 1786648457, +3 more Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779838819, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779839447, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887217, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779891163, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779147132 Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779828691, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779828813, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779828536, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779837290, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779835152 Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780320809, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780321673, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779839087, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780370487, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779839762not affected: vulnerable code not present
+1 more productsfewer
Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780361828, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780615638, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887500, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780616828, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779815431 -
Red Hat OpenShift Service Mesh 2 ossm-2/openshift-golang-builder-container, openshift-service-mesh/istio-rhel8-operatornot affected: vulnerable code not in execute path
-
Red Hat OpenShift Service Mesh 3 ossm-2/openshift-golang-builder-containernot affected: vulnerable code not present
-
Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9not affected: inline mitigations already exist
-
Red Hat Ansible Automation Platform 2 ansible-automation-platform/platform-operator-bundle Red Hat Enterprise Linux 9 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat Enterprise Linux 10 golangnot affected: vulnerable code not present
-
Red Hat Hardened Images hugonot affected: vulnerable code not in execute path
-
Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel9not affected: component not present
-
Red Hat OpenShift Container Platform 4 openshift4/ose-tests-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9not affected: vulnerable code not in execute path
-
Red Hat OpenShift Virtualization 4 ossm-2/openshift-golang-builder-containernot affected: vulnerable code not present
-
Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundlenot affected: vulnerable code not in execute path
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | golang.org/x/image | <0.42.0 |
0.42.0 |
Affected products
- golang.org/x/image golang.org/x/image/webp
References
-
go.dev
/cl/759860
patch
-
go.dev
/cl/780860
patch
-
pkg.go.dev
/vuln/GO-2026-4961
vendor-advisory
-
go.dev
/issue/78407
issue-tracking, report
Sources
- CVE List CVE-2026-33813
- NVD CVE-2026-33813
- OSV GO-2026-4961
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.