BDSA-2026-16933
BDSA
Medium
False Positivex/image/tiff: Panic via Out-of-Bounds Strip Offset
This advisory does not affect KrakenD
The TIFF decoder is not compiled into the KrakenD binary, so the vulnerable code is
not present.
No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its BDSA identifier.
Component
Go extended library (x/image/tiff)
Disclosed
Nov 4, 2026
Description
The TIFF decoder in Go’s
golang.org/x/image module panics when it decodes a crafted
TIFF image with an out-of-bounds strip offset, so an attacker who can submit images
for decoding could crash the process. This does not affect KrakenD.