VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when parsing a crafted VP8L image containing many unused Huffman tree groups. The result is a memory exhaustion failure, which can cause a denial of service. This weakness is an uncontrolled memory allocation flaw that enables an attacker to deplete available system memory by sending specially crafted images.

The vulnerable product is golang.org/x/image:golang.org/x/image/vp8l. No specific version data were provided, so any build of this library that contains the current decoding routine requires attention.

The CVSS score of 7.5 indicates a high severity; the EPSS score is not available and the vulnerability is not listed in CISA KEV, so the exploitation probability is unknown. An attacker can remotely deliver a crafted VP8L image to a service using the vulnerable library, triggering excessive memory allocation and eventually exhausting system memory. The lack of a public exploit does not negate the risk; the weakness can be leveraged in a denial‑of‑service scenario with minimal prerequisites.