CVE-2026-33809

About vulnerability

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Affected product:

GoogleCloudPlatform/cloud-sql-proxy/cloudsql-proxy , Grafana , HdrHistogram/hdrhistogram-go , Loki , apache/arrow-go , apache/arrow/go , apache/arrow/go/arrow , bketelsen/crypt , blugelabs/bluge , bufbuild/protoc-gen-validate , census-ecosystem/opencensus-go-exporter-aws/aws , census-ecosystem/opencensus-go-exporter-stackdriver/stackdriver , census-instrumentation/opencensus-go , census-instrumentation/opencensus-proto , centrifugal/centrifuge , cloud.google.com/go , cloud.google.com/go/bigquery , cloud.google.com/go/firestore , cloud.google.com/go/storage , cncf/xds/go , containerd/containerd , containerd/continuity , cortexproject/cortex , eliasnaur/gio , envoyproxy/go-control-plane , etcd-io/etcd , etcd-io/etcd/api , etcd-io/etcd/client , etcd-io/etcd/pkg , etcd-io/etcd/server , gioui.org , git.sr.ht/~sbinet/gg , github.com/apache/arrow/go , github.com/bketelsen/crypt , github.com/centrifugal/centrifuge , github.com/cncf/xds/go , github.com/cortexproject/cortex , github.com/envoyproxy/protoc-gen-validate , github.com/go-fonts/dejavu , github.com/go-fonts/latin-modern , github.com/go-fonts/liberation , github.com/go-fonts/stix , github.com/go-kit/kit , github.com/go-latex/latex , github.com/go-pdf/fpdf , github.com/googleapis/google-cloud-go-testing , github.com/grafana/gofpdf , github.com/grpc-ecosystem/go-grpc-middleware , github.com/influxdata/flux , github.com/influxdata/influxdb , github.com/influxdata/tdigest , github.com/influxdata/telegraf , github.com/jung-kurt/gofpdf , github.com/lyft/protoc-gen-star , github.com/phpdave11/gofpdf , github.com/prometheus/client_golang , github.com/prometheus/common , github.com/prometheus/prometheus , github.com/ruudk/golang-pdf417 , github.com/spf13/afero , github.com/spf13/cobra , github.com/spf13/viper , go-fonts/dejavu , go-fonts/latin-modern , go-fonts/liberation , go-fonts/stix , go-kit/kit , go-latex/latex , go-pdf/fpdf , go.etcd.io/etcd , go.etcd.io/etcd/client , go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc , gobuffalo/buffalo-plugins , gobuffalo/genny , gobuffalo/licenser , gobuffalo/packr , gobuffalo/plushgen , gobuffalo/pop , gobuffalo/release , golang.org/x/exp , golang.org/x/image , golang.org/x/mobile , gonum.org/v1/gonum , gonum.org/v1/plot , gonum/exp/gonum , gonum/exp/netlib , gonum/exp/plot , google.golang.org/grpc , google/go-cloud , google/go-replayers/grpcreplay , google/go-replayers/httpreplay , google/s2a-go , googleapis/gax-go , googleapis/go-genproto , googleapis/go-genproto/googleapis/rpc , googleapis/google-api-go-client , googleapis/google-cloud-go , googleapis/google-cloud-go-testing , googleapis/google-cloud-go/auth , googleapis/google-cloud-go/bigquery , googleapis/google-cloud-go/bigtable , googleapis/google-cloud-go/compute , googleapis/google-cloud-go/datastore , googleapis/google-cloud-go/firestore , googleapis/google-cloud-go/longrunning , googleapis/google-cloud-go/pubsub , googleapis/google-cloud-go/storage , googlesource/exp , googlesource/image , googlesource/mobile , grafana/dataplane/sdata , grafana/e2e , grafana/gofpdf , grafana/grafana-azure-sdk-go , grafana/grafana-plugin-sdk-go , grafana/tempo , grpc-ecosystem/go-grpc-middleware , grpc-ecosystem/go-grpc-prometheus , grpc-ecosystem/grpc-gateway , grpc/grpc-go , hashicorp/go-plugin , hashicorp/vault/api , hashicorp/vault/sdk , influxdata/flux , influxdata/influxdb , influxdata/tdigest , influxdata/telegraf , jaegertracing/jaeger , jung-kurt/gofpdf , k8s.io/component-base , knadh/koanf , kubernetes/apiserver , kubernetes/client-go , kubernetes/component-base , luna-duclos/instrumentedsql , lyft/protoc-gen-star , mostynb/go-grpc-compression , open-telemetry/opentelemetry-collector , open-telemetry/opentelemetry-collector-contrib/exporter/jaegerexporter , open-telemetry/opentelemetry-collector-contrib/exporter/kafkaexporter , open-telemetry/opentelemetry-collector-contrib/exporter/zipkinexporter , open-telemetry/opentelemetry-collector-contrib/internal/coreinternal , open-telemetry/opentelemetry-collector-contrib/internal/sharedcomponent , open-telemetry/opentelemetry-collector-contrib/pkg/translator/jaeger , open-telemetry/opentelemetry-collector-contrib/pkg/translator/opencensus , open-telemetry/opentelemetry-collector-contrib/pkg/translator/zipkin , open-telemetry/opentelemetry-collector-contrib/receiver/jaegerreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/kafkareceiver , open-telemetry/opentelemetry-collector-contrib/receiver/opencensusreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/zipkinreceiver , open-telemetry/opentelemetry-collector/component , open-telemetry/opentelemetry-collector/confmap , open-telemetry/opentelemetry-collector/consumer , open-telemetry/opentelemetry-collector/exporter , open-telemetry/opentelemetry-collector/exporter/otlpexporter , open-telemetry/opentelemetry-collector/otelcol , open-telemetry/opentelemetry-collector/pdata , open-telemetry/opentelemetry-collector/receiver , open-telemetry/opentelemetry-collector/receiver/otlpreceiver , open-telemetry/opentelemetry-collector/service , open-telemetry/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace , open-telemetry/opentelemetry-go/exporters/otlp/otlptrace/otlptracegrpc , open-telemetry/opentelemetry-proto-go/otlp , openfga/language/pkg/go , openfga/openfga , ory/analytics-go , ory/dockertest , ory/fosite , ory/go-acc , ory/jsonschema , ory/viper , ory/x , phpdave11/gofpdf , prometheus/client_golang , prometheus/common , prometheus/prometheus , ruudk/golang-pdf417 , sbinet/gg , spf13/afero , spf13/cobra , spf13/viper , thanos-io/objstore

Affected packages:

github.com/cncf/xds/go @ 0.0.0-20240905190251-b4127c9b8d78 (+332 more)