CVE-2026-33809
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Mar 25, 2026
CISA due date
—
The record
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | cg | 0 | 0 |
| Chainguard | chainctl | 0 | 0 |
| Chainguard | chainctl-fips | 0 | 0 |
| Chainguard | gatus | 0 | 0 |
| Chainguard | gatus-fips | 0 | 0 |
| Chainguard | gitea | 0 | 0 |
| Chainguard | gitea-fips | 0 | 0 |
| Chainguard | gitlab-workhorse-ce-18.10 | 0 | 0 |
| Chainguard | gitlab-workhorse-ce-18.8 | 0 | 0 |
| Chainguard | gitlab-workhorse-ce-18.9 | 0 | 0 |
| Chainguard | gitlab-workhorse-ce-fips-18.10 | 0 | 0 |
| Chainguard | gitlab-workhorse-ce-fips-18.8 | 0 | 0 |
| Chainguard | gitlab-workhorse-ce-fips-18.9 | 0 | 0 |
| Chainguard | glab | 0 | 0 |
| Chainguard | hugo | 0 | 0.159.1-r1 |
| Chainguard | hugo-extended | 0 | 0.159.0-r1 |
| Chainguard | hugo-fips | 0 | 0.159.1-r1 |
| Chainguard | kubescape | 0 | 0 |
| Chainguard | kubescape-server | 0 | 0 |
| Chainguard | kubescape-server-downloader | 0 | 0 |
| Chainguard | kubescape-server-fips | 0 | 0 |
| Chainguard | kubescape-server-fips-downloader | 0 | 0 |
| Chainguard | listmonk | 0 | 6.0.0-r6 |
| Chainguard | mailpit | 0 | 1.29.4-r1 |
| Chainguard | mailpit-fips | 0 | 1.29.4-r1 |
| Chainguard | mattermost-10.11 | 0 | 10.11.13-r3 |
| Chainguard | mattermost-11.4 | 0 | 11.4.3-r3 |
| Chainguard | mattermost-11.5 | 0 | 11.5.1-r3 |
| Chainguard | mattermost-fips-10.11 | 0 | 10.11.13-r3 |
| Chainguard | mattermost-fips-11.4 | 0 | 11.4.3-r3 |
| Chainguard | ollama | 0 | 0.19.0-r1 |
| Chainguard | ollama-fips | 0 | 0.19.0-r1 |
| Chainguard | pdfcpu | 0 | 0 |
| Chainguard | rclone | 0 | 1.73.3-r1 |
| Chainguard | rclone-fips | 0 | 1.73.3-r1 |
| Chainguard | seaweedfs | 0 | 4.18-r0 |
| Chainguard | seaweedfs-fips | 0 | 4.17-r2 |
| Chainguard | seaweedfs-operator | 0 | 1.0.11-r7 |
| Chainguard | seaweedfs-operator-fips | 0 | 1.0.11-r6 |
| Chainguard | tailscale | 0 | 0 |
| Wolfi | gatus | 0 | 0 |
| Wolfi | gitea | 0 | 0 |
| Wolfi | glab | 0 | 0 |
| Wolfi | hugo | 0 | 0.159.1-r1 |
| Wolfi | hugo-extended | 0 | 0.159.0-r1 |
| Wolfi | kubescape | 0 | 0 |
| Wolfi | mailpit | 0 | 1.29.4-r1 |
| Wolfi | mattermost-10.11 | 0 | 10.11.13-r3 |
| Wolfi | mattermost-11.4 | 0 | 11.4.3-r3 |
| Wolfi | mattermost-11.5 | 0 | 11.5.1-r3 |
| Wolfi | ollama | 0 | 0.19.0-r1 |
| Wolfi | pdfcpu | 0 | 0 |
| Wolfi | rclone | 0 | 1.73.3-r1 |
| Wolfi | seaweedfs | 0 | 4.18-r0 |
| Wolfi | tailscale | 0 | 0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260326T203309-150000.1.155.2 |
| openSUSE:Leap 16.0 | neonmodem | 0 | 1.0.7+git0.346d1d3-bp160.1.1 |
| openSUSE:Tumbleweed | pocketbase | 0 | 0.37.3-1.1 |
| openSUSE:Tumbleweed | rclone | 0 | 1.74.2-1.1 |
Related vulnerabilities
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects cg
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects cg
- CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON… Also affects cg
- CVE-2026-33481 Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM)… Also affects cg
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects cg
- CVE-2026-1229 The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an… Also affects cg
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects cg
- CVE-2026-25934 go-git is a highly extensible git implementation library written in pure Go. Also affects cg