CVE-2026-33582: Go Generic Image Decode Sniffing
Calling generic 'image.Decode' or 'image.DecodeConfig' dynamically dispatches image decoding based on magic bytes among all registered formats. Transitive dependencies may register decoders (e.g., TIFF) prone to excessive memory consumption or denial of service on untrusted inputs. Prefer using format-specific decoders (such as jpeg.Decode, png.Decode, gif.D
Gogreprules fetch cve-2026-33582-go-generic-image-decode-sniffing --engine opengrepDescription
Calling generic 'image.Decode' or 'image.DecodeConfig' dynamically dispatches image decoding based on magic bytes among all registered formats. Transitive dependencies may register decoders (e.g., TIFF) prone to excessive memory consumption or denial of service on untrusted inputs. Prefer using format-specific decoders (such as jpeg.Decode, png.Decode, gif.D
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.