games-on-whales/fenrir
1
0
Fork 0
mirror of https://github.com/games-on-whales/fenrir.git synced 2026-10-15 12:51:53 +00:00
Code Issues 20 Projects Packages Wiki Activity

[PR #15] Update module golang.org/x/image to v0.41.0 [SECURITY] #17

New issue
Open
opened 2026-10-15 12:46:39 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-15 12:46:39 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/fenrir/pull/15
Author: @renovate[bot]
Created: 7/13/2026
Status: 🔄 Open

Base: main ← Head: renovate/go-golang.org-x-image-vulnerability

📝 Commits (1)

  • e268396 Update module golang.org/x/image to v0.41.0 [SECURITY]

📊 Changes

2 files changed (+23 additions, -10 deletions)

View changed files

📝 go.mod (+10 -10)
📝 go.sum (+13 -0)

📄 Description

This PR contains the following updates:

Package Change Age Confidence
golang.org/x/image v0.24.0 → v0.41.0 age confidence

Go Images vulnerable to an out-of-memory error via a crafted TIFF file

CVE-2026-33809 / GHSA-44p7-9xx4-hf2g

More information

Details

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

CVE-2026-46599 / GHSA-q675-qj96-32m9

More information

Details

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/fenrir/pull/15 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 7/13/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `renovate/go-golang.org-x-image-vulnerability` --- ### 📝 Commits (1) - [`e268396`](https://github.com/games-on-whales/fenrir/commit/e26839612f3adc249e429b16a6111b0aa1723470) Update module golang.org/x/image to v0.41.0 [SECURITY] ### 📊 Changes **2 files changed** (+23 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+10 -10) 📝 `go.sum` (+13 -0) </details> ### 📄 Description This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) | [`v0.24.0` → `v0.41.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.24.0...refs/tags/v0.41.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fimage/v0.41.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fimage/v0.24.0/v0.41.0?slim=true) | --- ### Go Images vulnerable to an out-of-memory error via a crafted TIFF file [CVE-2026-33809](https://nvd.nist.gov/vuln/detail/CVE-2026-33809) / [GHSA-44p7-9xx4-hf2g](https://redirect.github.com/advisories/GHSA-44p7-9xx4-hf2g) <details> <summary>More information</summary> #### Details A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-33809](https://nvd.nist.gov/vuln/detail/CVE-2026-33809) - [https://go.dev/cl/757660](https://go.dev/cl/757660) - [https://go.dev/issue/78267](https://go.dev/issue/78267) - [https://pkg.go.dev/vuln/GO-2026-4815](https://pkg.go.dev/vuln/GO-2026-4815) - [https://github.com/advisories/GHSA-44p7-9xx4-hf2g](https://redirect.github.com/advisories/GHSA-44p7-9xx4-hf2g) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-44p7-9xx4-hf2g) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### golang.org/x/image/tiff has excessive resource consumption in PackBits decompression [CVE-2026-46599](https://nvd.nist.gov/vuln/detail/CVE-2026-46599) / [GHSA-q675-qj96-32m9](https://redirect.github.com/advisories/GHSA-q675-qj96-32m9) <details> <summary>More information</summary> #### Details The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-46599](https://nvd.nist.gov/vuln/detail/CVE-2026-46599) - [https://go.dev/cl/759960](https://go.dev/cl/759960) - [https://go.dev/issue/79577](https://go.dev/issue/79577) - [https://groups.google.com/g/golang-announce/c/uhYX90BlBvI](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI) - [https://pkg.go.dev/vuln/GO-2026-5032](https://pkg.go.dev/vuln/GO-2026-5032) - [https://github.com/advisories/GHSA-q675-qj96-32m9](https://redirect.github.com/advisories/GHSA-q675-qj96-32m9) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-q675-qj96-32m9) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/games-on-whales/fenrir). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTkuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjYwLjEiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/helm-4.x
renovate/go-golang.org-x-net-vulnerability
renovate/common-5.x
renovate/mikefarah-yq-4.x
renovate/kubernetes-monorepo
renovate/alpine-3.x
renovate/helm-3.x
renovate/k8s.io-utils-digest
renovate/go-golang.org-x-image-vulnerability
renovate/pin-dependencies
feature/direwolf-dra
feature/wolf-dra-sessions
staging
chore/golang-1.26
feature/wolf-dra-driver
renovate/golang-1.x
chore/restructure-structs
chore/update-skaffold
chore/labels-and-enums
feature/better-moonlight-login
renovate/common-4.x
chore/ci-workflows
features/lobbies
feat/image-flags
fix/wolf-registry
No results found.
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
games-on-whales/fenrir#17
No description provided.