BDSA-2026-17353
BDSA
Medium
False Positivex/image: Unbounded Memory Allocation When Decoding a Crafted Image
This advisory does not affect KrakenD
The WebP and VP8 decoders are present in KrakenD Enterprise only because of the machine
learning library that computes text embeddings for the semantic cache. KrakenD uses
that library in text-only mode and never decodes images, so the vulnerable code is
never executed.
No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its BDSA identifier.
Component
Go extended library (x/image)
Disclosed
Nov 4, 2026
Description
Image decoding code in Go’s
golang.org/x/image module can be made to allocate an
unbounded amount of memory by a crafted image, so an attacker who can submit images for
decoding could exhaust the memory of the process. This does not affect KrakenD.