BDSA-2026-17354
BDSA
Medium
False Positivex/image/vp8: Panic via Mismatched Chunk Dimensions
This advisory does not affect KrakenD
The WebP and VP8 decoders are present in KrakenD Enterprise only because of the machine
learning library that computes text embeddings for the semantic cache. KrakenD uses
that library in text-only mode and never decodes images, so the vulnerable code is
never executed.
No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its BDSA identifier.
Component
Go extended library (x/image/vp8)
Disclosed
Nov 4, 2026
Description
The VP8 decoder in Go’s
golang.org/x/image module panics when it decodes a crafted
image whose VP8 chunk dimensions do not match, so an attacker who can submit
images for decoding could crash the process. This does not affect KrakenD.