medium6.9
CVE-2025-32024
bep/imagemeta allows excessively large EXIF data structures
Impact
### Impact The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before `v0.10.0`, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. ### Patches `v0.10.0` added LimitNumTags (default 5000) and LimitTagSize (default 10000) options.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/bep/imagemeta | < 0.10.0 | 0.10.0 |
Affected products
| Product | Affected versions |
|---|---|
| Relatively Small Payloads. | before 0.10.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.