CVE-2026-46599: TIFF Decoder DOS Vulnerability

CVE-2026-46599 Overview

CVE-2026-46599 is a denial-of-service vulnerability in the Go programming language TIFF image decoder. The decoder fails to enforce a limit on the size of PackBits-compressed data within a TIFF image. A maliciously-crafted image with small declared dimensions and a small on-disk footprint can instruct the decoder to process disproportionately large amounts of compressed data. Applications that accept untrusted TIFF input through Go's image-processing libraries are exposed to resource exhaustion. The issue is tracked as GO-2026-5032 and classified under [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A network-reachable attacker can submit a small, malformed TIFF file that forces the Go TIFF decoder to consume excessive CPU and memory, causing service degradation or outright denial of service.

Affected Products

Go standard library and supplementary golang.org/x/image/tiff package
Applications and services built with Go that decode untrusted TIFF input
Image-processing pipelines, thumbnailers, and web upload handlers using the Go TIFF decoder

Discovery Timeline

2026-05-29 - CVE-2026-46599 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-46599

Vulnerability Analysis

The Go TIFF decoder processes PackBits-compressed image strips without validating compressed payload size against the declared image dimensions. PackBits is a simple run-length encoding scheme used by the TIFF format. A well-formed TIFF declares pixel width, height, and per-strip byte counts that should bound how much compressed data is read and expanded.

The decoder honors the StripByteCounts field from the TIFF Image File Directory without cross-checking it against the actual pixel area. An attacker can declare a tiny image (for example, 1x1 pixels) while embedding strip byte counts that point to large compressed runs. The decoder then reads and expands that data, allocating buffers and burning CPU cycles. This is a classic uncontrolled resource consumption pattern captured by [CWE-770].

Root Cause

The root cause is missing input validation between two TIFF metadata fields: image geometry and compressed strip size. The PackBits decoding loop iterates over the compressed input until it is exhausted rather than stopping after producing the number of output bytes implied by image width, height, and bits-per-sample. Without an upper bound tied to image geometry, the decoder treats attacker-controlled length fields as authoritative.

Attack Vector

Exploitation requires no authentication and no user interaction beyond submitting a TIFF file to a vulnerable service. Any network-facing Go application that accepts TIFF uploads, fetches remote TIFF resources, or renders user-supplied images is reachable. Typical targets include avatar processors, document-conversion services, OCR pipelines, and cloud functions that thumbnail uploaded media. The result is CPU saturation, memory pressure, or process termination by the runtime.

No verified public exploit code is available. Technical details are tracked in the Go vulnerability database entry GO-2026-5032, the upstream change list, and Go issue 79577.

Detection Methods for CVE-2026-46599

Indicators of Compromise

Sudden spikes in CPU and resident memory in Go processes that decode images, often correlated with a single inbound TIFF request.
Out-of-memory kills or goroutine stack growth warnings in services using image/tiff or golang.org/x/image/tiff.
HTTP requests delivering TIFF payloads where declared image dimensions are minimal but the compressed strip data is disproportionately large.

Detection Strategies

Inspect TIFF uploads server-side and flag files whose StripByteCounts sum exceeds a plausible bound derived from ImageWidth, ImageLength, and BitsPerSample.
Instrument the image-decoding path with per-request CPU time and allocation ceilings, alerting when a single decode crosses the threshold.
Use the govulncheck tool against build artifacts to identify binaries that link the vulnerable TIFF decoder symbols.

Monitoring Recommendations

Track process-level metrics for image-handling workers, including RSS, GC pause time, and goroutine counts, and alert on anomalies.
Log content-type, file size, and decode duration for every accepted image, then correlate outliers against client IP and account.
Forward web application firewall and reverse proxy logs to a centralized analytics platform for retrospective hunting on malformed TIFF submissions.

How to Mitigate CVE-2026-46599

Immediate Actions Required

Rebuild affected Go services using a Go toolchain and golang.org/x/image release that contains the fix referenced in Go CL 759960 and the golang-announce update.
Run govulncheck ./... against all Go modules and container images to identify call sites that reach the vulnerable TIFF decoder.
Restrict accepted image formats at the edge, rejecting TIFF where it is not a required input.

Patch Information

The Go team has published a fix tracked under GO-2026-5032. The patch enforces an upper bound on PackBits-compressed data tied to the declared image geometry, causing oversized strips to be rejected before decoding. Update to the patched release of Go or golang.org/x/image/tiff, then redeploy all dependent services and container images.

Workarounds

Enforce a strict maximum file size on TIFF uploads at the load balancer, reverse proxy, or application layer before the decoder is invoked.
Decode untrusted images in a sandboxed worker with hard CPU and memory limits, such as a container with cgroup constraints or a context.Context deadline around the decode call.
Pre-validate TIFF headers and reject files whose strip byte counts are inconsistent with declared width, height, and bits-per-sample.

bash

# Configuration example: identify and update vulnerable Go modules
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

# Update the affected image package
go get -u golang.org/x/image/tiff
go mod tidy
go build ./...