CVE-2026-46601
CVE
High
· CVSS 7.5
False Positivex/image/webp: Panic via VP8 Alpha Channel Size Mismatch
This advisory does not affect KrakenD
KrakenD Community Edition does not depend on
golang.org/x/image. KrakenD Enterprise
links the WebP decoder indirectly through the embeddings library used by the semantic
cache (ai/semantic-cache), which registers WebP support for its image pipelines.
KrakenD only uses the text feature extraction pipeline of that library to vectorize
prompts; the image loading functions that call the decoder are never invoked, and no
other KrakenD component decodes images. Request and response bodies, including image
payloads, are proxied as raw bytes and never parsed by the WebP decoder.Addressed through routine dependency maintenance in EE 3.0.4.
Component
Go extended library (x/image/webp)
Disclosed
Nov 12, 2026
CVSS Score
7.5
Description
The WebP decoder in
golang.org/x/image/webp did not check that the dimensions of a VP8
chunk match the canvas size. When the image also contains an alpha channel chunk, the
decoder builds an image with mismatched color and alpha data and panics when it accesses
alpha data out of bounds. A remote attacker able to submit such an image to an application
that decodes it could crash the process. The issue is fixed in golang.org/x/image v0.43.0.
This does not affect KrakenD, which never decodes images received from clients or backends.