CVE-2026-46603: 
Tailscale vulnerability analysis and mitigation

CVE-2026-46603 is a memory exhaustion vulnerability in the VP8L decoding implementation of the golang.org/x/image/vp8l Go package. When processing a crafted VP8L image containing many unused Huffman tree groups, the decoder can allocate an excessive amount of memory, enabling a remote attacker to cause a denial of service. All versions of golang.org/x/image/vp8l before 0.45.0 are affected. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, OSV).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value). During VP8L image decoding, the library allocates memory for Huffman tree groups without adequately validating or bounding the number of such groups present in the image stream — including groups that are never actually used during decoding. An attacker can craft a malicious VP8L image with a large number of unused Huffman tree groups, triggering unbounded memory allocation when the image is processed. No authentication or user interaction is required, and the attack is network-deliverable, making it automatable. The fix is tracked in Go issue #80069 and code change CL 793460 (OSV, Go Issue).

Successful exploitation causes memory exhaustion on the host running the vulnerable Go application, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Any service that accepts and decodes VP8L images using the affected package (e.g., image processing APIs, web applications, or media pipelines) is at risk of crashing or becoming unresponsive when processing a malicious image (Feedly, OSV).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The NVD SSVC assessment indicates no known exploitation and partial technical impact, though the attack is rated as automatable due to the lack of authentication or user interaction requirements. The EPSS score is approximately 0.417%, reflecting a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, OSV).

1. Craft a malicious VP8L image: Create a VP8L-encoded image file that specifies a very large number of Huffman tree groups in its header, the majority of which are unused during actual pixel decoding.
2. Identify a target: Find a service or application that accepts user-supplied images and decodes them using the golang.org/x/image/vp8l package (versions < 0.45.0), such as an image upload endpoint or media processing API.
3. Submit the malicious image: Upload or send the crafted VP8L image to the target service via HTTP, API call, or any other supported input channel.
4. Trigger memory exhaustion: The vulnerable decoder allocates memory for all declared Huffman tree groups (including unused ones) without bounds checking, rapidly consuming available system memory.
5. Achieve denial of service: The target process exhausts available memory, causing it to crash, become unresponsive, or trigger OOM-killer intervention, resulting in service disruption (OSV, Go Issue).

• Network: Repeated HTTP requests submitting VP8L image files (magic bytes: RIFF....WEBPVP8L) to image processing endpoints from external or unexpected sources.
• Process: Go application processes exhibiting sudden, rapid memory growth (RSS/VSZ) when processing image uploads, potentially triggering OOM kills.
• Logs: Application logs showing out-of-memory errors, panics, or crashes in the golang.org/x/image/vp8l decoder; OS-level OOM killer log entries (kernel: Out of memory: Kill process) coinciding with image processing activity.
• File System: Presence of unusually large or malformed .webp or VP8L image files in upload directories or temporary processing folders.

Upgrade golang.org/x/image to version 0.45.0 or later, which includes the fix for this vulnerability. Applications using the affected package should update their go.mod dependency and rebuild. If an immediate upgrade is not possible, consider implementing file size limits and content-type validation on image upload endpoints to reduce exposure, and rate-limit image processing requests to mitigate the denial-of-service risk (OSV, Go CL).