← Scan another repo

github.com/jung-kurt/gofpdf

@ 0c885ad36193

Submitted 8/4/2026, 1:46:00 AM · Status: ok

Risk grade
F
100 / 100
Findings
196
0 critical13 high30 medium0 low153 info0 on CISA KEV0ATT&CK
Showing 196 of 196 findings

Findings

  • golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
    grypeCVE-2026-46599EPSS 0.4%
  • Panic when parsing invalid palette-color images in golang.org/x/image
    grypeCVE-2024-24792EPSS 0.7%
  • Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
    grypeCVE-2026-33813EPSS 0.3%
  • The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
    grypeCVE-2026-46604EPSS 0.3%
  • The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded si
    The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
    grypeCVE-2026-46599EPSS 0.4%
  • The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
    grypeCVE-2026-46602EPSS 0.3%
  • The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
    grypeCVE-2026-46601EPSS 0.3%
  • A norm.Iter can enter an infinite loop when handling input containing ...
    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
    trivyCVE-2026-56852
  • golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
    An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
    trivyCVE-2022-32149
  • golang: out-of-bounds read in golang.org/x/text/language leads to DoS
    golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
    trivyCVE-2021-38561
  • golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM o…
    trivyCVE-2020-14040
  • The TIFF decoder can panic when decoding an invalid image with an out- ...
    The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
    trivyCVE-2026-46604
  • The TIFF decoder does not set a limit on the size of tiles in tiled im ...
    The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
    trivyCVE-2026-46602

This report is public.