{"id":"GO-2026-5061","summary":"Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image","details":"The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.","aliases":["CVE-2026-46601"],"modified":"2026-06-26T13:44:18.873843227Z","published":"2026-06-18T22:46:58Z","related":["CGA-hmqw-pfj6-99cq"],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5061","review_status":"REVIEWED"},"references":[{"type":"FIX","url":"https://go.dev/cl/787681"},{"type":"REPORT","url":"https://go.dev/issue/79869"}],"affected":[{"package":{"name":"golang.org/x/image","ecosystem":"Go","purl":"pkg:golang/golang.org/x/image"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.43.0"}]}],"ecosystem_specific":{"imports":[{"symbols":["Decode","DecodeConfig","decode"],"path":"golang.org/x/image/webp"},{"path":"golang.org/x/image/webp"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5061.json"}}],"schema_version":"1.7.5","credits":[{"name":"Lucas Futures (GitHub: gn00295120)"}]}