CVE-2023-29408
Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
CVE-2023-29408- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List No score
Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
CVE-2023-29408- Updated
- 2026-11-02
EUVDEUVD-2023-2378
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
EUVD-2023-2378- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x92r-3vfx-4cv3
Golang TIFF decoder does not place a limit on the size of compressed tile data
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
GHSA-x92r-3vfx-4cv3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-29408
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
DEBIAN-CVE-2023-29408- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-x92r-3vfx-4cv3
Golang TIFF decoder does not place a limit on the size of compressed tile data
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
GHSA-x92r-3vfx-4cv3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2023-29408
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
UBUNTU-CVE-2023-29408- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
CVE-2023-29408- Updated
- 2026-11-02
OSVGO-2023-1989 No score
Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.
- Record
GO-2023-1989- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:0194-2 No score
Security update for keybase-client
This update for keybase-client fixes the following issues:
Update to version 6.2.8
- Update client CA
- Fix incomplete locking in config file handling.
- Update the Image dependency to address CVE-2023-29408 / boo#1213928. This is done via the new update-image-tiff.patch.
- Limit parallel test execution as that seems to cause failing builds on OBS that don't occur locally.
- Integrate KBFS packages previously build via own source package
- Upstream integrated these into the same source.
- Also includes adding kbfs-related patches ensure-mount-dir-exists.patch and ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Record
openSUSE-SU-2024:0194-2- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13103-1 No score
kbfs-6.2.2-2.1 on GA media
These are all security issues fixed in the kbfs-6.2.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13103-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang.org/x/imageGo |
before 0.10.0 | 0.10.0 |
golang-golang-x-imageDebian:12 |
All versions, plus listed versions 0.11.0-10.12.0-10.13.0-10.14.0-10.15.0-1 Show 13 moreShow less0.16.0-10.18.0-10.32.0-10.35.0-10.38.0-10.39.0-10.42.0-10.45.0-10.47.0-10.5.0-10.7.0-10.8.0-10.9.0-1 |
None known |
golang-golang-x-imageDebian:13 |
before 0.11.0-1 | 0.11.0-1 |
golang-golang-x-imageDebian:14 |
before 0.11.0-1 | 0.11.0-1 |
golang-golang-x-imageUbuntu:18.04:LTS |
All versions, plus listed versions 0.0~git20170523.0.426cfd8-1 |
None known |
golang-golang-x-imageUbuntu:20.04:LTS |
All versions, plus listed versions 0.0~git20190703.d6a02ce-10.0~git20200119.58c2397-1 |
None known |
golang-golang-x-imageUbuntu:22.04:LTS |
All versions, plus listed versions 0.0~git20200119.58c2397-10.0~git20210628.a66eb64-10.0~git20211028.6944b10-1 |
None known |
golang-golang-x-imageUbuntu:24.04:LTS |
All versions, plus listed versions 0.7.0-10.13.0-10.14.0-10.15.0-1 |
None known |
golang-golang-x-imageUbuntu:25.10 |
All versions, plus listed versions 0.18.0-1 |
None known |
golang-golang-x-imageUbuntu:26.10 |
All versions, plus listed versions 0.35.0-10.39.0-10.42.0-10.45.0-1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
golang-golang-x-imageUbuntu:26.04:LTS |
All versions, plus listed versions 0.18.0-10.32.0-10.35.0-1 |
None known |
keybase-clientSUSE:Package Hub 15 SP5 |
before 6.2.8-bp156.2.3.1 | 6.2.8-bp156.2.3.1 |
keybase-clientSUSE:Package Hub 15 SP6 |
before 6.2.8-bp156.2.3.1 | 6.2.8-bp156.2.3.1 |
keybase-clientopenSUSE:Leap 15.5 |
before 6.2.8-bp156.2.3.1 | 6.2.8-bp156.2.3.1 |
keybase-clientopenSUSE:Leap 15.6 |
before 6.2.8-bp156.2.3.1 | 6.2.8-bp156.2.3.1 |
keybase-clientopenSUSE:Tumbleweed |
before 6.2.2-2.1 | 6.2.2-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-29408 is a medium vulnerability (CVSS 6.5) in Golang Image, published August 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in golang.org/x/image 0.10.0.
References
go.dev/issue/61582
pkg.go.dev/vuln/GO-2023-1989
security.netapp.com/advisory/ntap-20230831-0009
lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-29408
github.com/advisories/GHSA-x92r-3vfx-4cv3
security-tracker.debian.org/tracker/CVE-2023-29408
ubuntu.com/security/CVE-2023-29408
cve.org/CVERecord?id=CVE-2023-29408
lists.opensuse.org/archives/list/[email protected]/thread/PKFUM343ZIFFU5562L2AAJWE2OVIJBOH
bugzilla.suse.com/1213928
suse.com/security/cve/CVE-2023-29408