GHSA-fmhh-rw3h-785m

Source

https://github.com/advisories/GHSA-fmhh-rw3h-785m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-fmhh-rw3h-785m/GHSA-fmhh-rw3h-785m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fmhh-rw3h-785m

Aliases

Related

Published

2025-04-09T12:57:56Z

Modified

2025-04-09T17:42:01.114180Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing

Details

Impact

The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks.

Patches

v0.11.0 added a 10 MB upper limit.

Database specific

{
    "nvd_published_at": "2025-04-08T16:15:27Z",
    "cwe_ids": [
        "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-09T12:57:56Z"
}

References

Affected packages

Go / github.com/bep/imagemeta

Package

Name: github.com/bep/imagemeta; View open source insights on deps.dev
Purl: pkg:golang/github.com/bep/imagemeta

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.11.0