{"id":"GO-2026-4962","revision":"ebd2b4a406c04598b936fa803a11f6f4","records":[{"revision":"ebd2b4a406c04598b936fa803a11f6f4","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4962","aliases":["CVE-2026-33812"],"title":"Excessive memory allocation when decoding malicious SFNT in golang.org/x/image","description":"Parsing a malicious font file can cause excessive memory allocation.","state":0,"publishedAt":"2026-04-21T18:59:51+00:00","modifiedAt":"2026-09-22T10:41:47.7228401+00:00","affected":[{"ecosystem":"Go","name":"golang.org/x/image","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.39.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/761180","https://go.dev/issue/78382"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4962","license":"OSV · upstream source license applies","key":"osv:GO-2026-4962","identifiers":["GO-2026-4962","CVE-2026-33812"]},"retained":false,"historicalAffected":[]}],"coverage":[]}