CVE-2026-46604
CVE
High
· CVSS 7.5
False Positivex/image/tiff: Panic via Out-of-Bounds Strip Offset
This advisory does not affect KrakenD
The
golang.org/x/image/tiff package is not compiled into any KrakenD binary. KrakenD
Community Edition does not depend on golang.org/x/image at all, and KrakenD Enterprise
only pulls the module indirectly through the embeddings library used by the semantic
cache, which links the WebP decoder but never the TIFF one. There is no code path in
KrakenD that can parse a TIFF image.Addressed through routine dependency maintenance in EE 3.0.4.
Component
Go extended library (x/image/tiff)
Disclosed
Nov 12, 2026
CVSS Score
7.5
Description
The TIFF decoder in
golang.org/x/image/tiff panics when it decodes an invalid image
containing an out-of-bounds strip offset. A remote attacker able to submit such an image
to an application that decodes it could crash the process. The issue is fixed in
golang.org/x/image v0.43.0.
This does not affect KrakenD, which never decodes TIFF images.