A memory allocation vulnerability in the golang.org/x/image/vp8l decoder allows unauthenticated attackers to trigger a denial of service through specially crafted image files.

This vulnerability is caused by memory allocation with an excessive size value (CWE-789) when decoding VP8L images. An unauthenticated attacker can submit a malicious image file to an application using this library, forcing the system to allocate excessive memory and causing a crash.

The CVSS score of 7.5 reflects the high impact on service availability. Applications that process user-supplied images are particularly at risk, as this vulnerability provides a trivial path for attackers to crash backend services, leading to potential operational disruption.

Immediate Action: Update the golang.org/x/image dependency to version 0.45.0 or later to resolve the memory allocation defect.

Proactive Monitoring: Monitor application crash logs and memory usage patterns for services that handle image uploads or processing.

Compensating Controls: Use image processing pipelines that perform strict validation and sanitization of image headers before they reach the decoding library to mitigate the risk of malicious payloads.

Public Exploit Available: Unknown

Developers should immediately update their Go dependencies to the patched version. Given the ease with which this vulnerability can be automated by attackers, prompt remediation is necessary to prevent potential denial of service attacks against image-processing infrastructure.