CVE-2023-29408

Excessive resource consumption in golang.org/x/image/tiff

published August 2, 2023

CVSS
—
EPSS
1%
Percentile
60.3
In the wild
Unconfirmed
What it is

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00933 · 60.3th percentile
Published
2023-08-02T19:52Z
EPSS history
Timeline
  • 02 AUG 19:52Z
    Excessive resource consumption in golang.org/x/image/tiff
    cvelistv5