News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-46602 CVE High · CVSS 7.5 False Positive

x/image/tiff: Unbounded Memory Allocation via Oversized Image Tiles

This advisory does not affect KrakenD

The golang.org/x/image/tiff package is not compiled into any KrakenD binary. KrakenD Community Edition does not depend on golang.org/x/image at all, and KrakenD Enterprise only pulls the module indirectly through the embeddings library used by the semantic cache, which links the WebP decoder but never the TIFF one. There is no code path in KrakenD that can parse a TIFF image.

Component

Go extended library (x/image/tiff)

Disclosed

Jun 25, 2026

CVSS Score

7.5

Description

The TIFF decoder in golang.org/x/image/tiff did not limit the size of tiles in tiled images. A malicious or corrupt TIFF image declaring a very large tile could make the decoder allocate an unbounded amount of memory, leading to a denial of service through memory exhaustion. The issue is fixed in golang.org/x/image v0.43.0. This does not affect KrakenD, which never decodes TIFF images.

References

View CVE-2026-46602 on NVD View CVE-2026-46602 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates