{"id":"GO-2026-4961","revision":"ed4c5e6737754e44b73a29f8a9a705f0","records":[{"revision":"ed4c5e6737754e44b73a29f8a9a705f0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4961","aliases":["CVE-2026-33813"],"title":"Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image","description":"Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.","state":0,"publishedAt":"2026-04-21T18:59:43+00:00","modifiedAt":"2026-06-25T18:45:14.9335311+00:00","affected":[{"ecosystem":"Go","name":"golang.org/x/image","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.42.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/759860","https://go.dev/cl/780860","https://go.dev/issue/78407"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4961","license":"OSV · upstream source license applies","key":"osv:GO-2026-4961","identifiers":["GO-2026-4961","CVE-2026-33813"]},"retained":false,"historicalAffected":[]}],"coverage":[]}