Log in Start free

Vulnerability · Published Aug 2, 2023 · Assigned by Go

CVE-2023-29407Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff

Medium 6.5

In plain English

A medium-severity security flaw in golang.org/x/image/tiff from golang.org/x/image. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.9%top 40.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-golang-x-imageno fix listedDEBIAN-CVE-2023-29407
Debian:13golang-golang-x-image0.11.0-1DEBIAN-CVE-2023-29407
Debian:14golang-golang-x-image0.11.0-1DEBIAN-CVE-2023-29407
Gogolang.org/x/image0.10.0GHSA-j3p8-6mrq-6g7h
Gogolang.org/x/image0.10.0GO-2023-1990
Ubuntu:22.04:LTSgolang-golang-x-imageno fix listedUBUNTU-CVE-2023-29407
Ubuntu:24.04:LTSgolang-golang-x-imageno fix listedUBUNTU-CVE-2023-29407
Ubuntu:25.10golang-golang-x-imageno fix listedUBUNTU-CVE-2023-29407
Ubuntu:26.04:LTSgolang-golang-x-imageno fix listedUBUNTU-CVE-2023-29407
Ubuntu:26.10golang-golang-x-imageno fix listedUBUNTU-CVE-2023-29407

Affected products (as reported)

VendorProductVersions
golang.org/x/image golang.org/x/image/tiff 0 – before 0.10.0

References