From 98115ec2de1c1929c121073b3661e1ff39b4fcdc Mon Sep 17 00:00:00 2001 From: Lucas Frederico Roeder de Mello <104468335+lucasmellofred@users.noreply.github.com> Date: Fri, 4 Sep 2026 23:38:01 -0300 Subject: [PATCH] deps: update golang.org/x/image to v0.45.0 for CVE-2026-46603 (#11164) golang.org/x/image v0.44.0 is affected by CVE-2026-46603 (GO-2026-6222): a denial of service via excessive memory allocation when decoding malformed VP8L (lossless WebP) data. It is fixed in v0.45.0, released 2026-08-11. The decoder is reachable from SeaweedFS: weed/images/resizing.go blank-imports golang.org/x/image/webp, which registers the VP8L decoder with image.Decode, so the filer image resizing path decodes attacker supplied WebP data with the affected version. This is a go.mod/go.sum only change produced by `go get golang.org/x/image@v0.45.0 && go mod tidy`; no other dependency moved. `go build ./weed/`, `go vet ./weed/images/...`, `go test ./weed/images/...` and `go mod verify` all pass. Co-authored-by: Claude Opus 5 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 310c8c7b1..ff4f6e88a 100644 --- a/go.mod +++ b/go.mod @@ -92,7 +92,7 @@ require ( gocloud.dev/pubsub/rabbitpubsub v0.46.0 golang.org/x/crypto v0.55.0 golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 - golang.org/x/image v0.44.0 + golang.org/x/image v0.45.0 golang.org/x/net v0.58.0 golang.org/x/oauth2 v0.36.0 golang.org/x/sys v0.47.0 diff --git a/go.sum b/go.sum index c0f007e39..c709f5215 100644 --- a/go.sum +++ b/go.sum @@ -2217,8 +2217,8 @@ golang.org/x/image v0.0.0-20210607152325-775e3b0c77b9/go.mod h1:023OzeP/+EPmXeap golang.org/x/image v0.0.0-20210628002857-a66eb6448b8d/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM= golang.org/x/image v0.0.0-20211028202545-6944b10bf410/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM= golang.org/x/image v0.0.0-20220302094943-723b81ca9867/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM= -golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I= -golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY= +golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0= +golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=