CVE-2026-33813
CVE
High
· CVSS 7.5
False Positivex/image/webp: Corrupt Image Panic via Oversized Canvas on 32-bit Platforms
This advisory does not affect KrakenD
KrakenD Community Edition does not depend on
golang.org/x/image. KrakenD Enterprise
links the WebP decoder indirectly through the embeddings library used by the semantic
cache (ai/semantic-cache), which registers WebP support for its image pipelines.
KrakenD only uses the text feature extraction pipeline of that library to vectorize
prompts; the image loading functions that call the decoder are never invoked, and no
other KrakenD component decodes images. Request and response bodies, including image
payloads, are proxied as raw bytes and never parsed by the WebP decoder.Addressed through routine dependency maintenance in EE 3.0.4.
Component
Go extended library (x/image/webp)
Disclosed
Nov 12, 2026
CVSS Score
7.5
Description
On 32-bit platforms, the WebP decoder in
golang.org/x/image/webp accepted canvas
sizes whose pixel count overflows an int32 and returned a corrupt image that panics
when accessed. A remote attacker able to submit such an image to an application that
decodes it could crash the process. The issue is fixed in golang.org/x/image v0.42.0.
This does not affect KrakenD, which never decodes images received from clients or backends.