VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when parsing a crafted VP8L image containing many unused Huffman tree groups. The result is a memory exhaustion failure, which can cause a denial of service. This weakness is an uncontrolled memory allocation flaw that enables an attacker to deplete available system memory by sending specially crafted images.

The vulnerable product is golang.org/x/image:golang.org/x/image/vp8l. No specific version data were provided, so any build of this library that contains the current decoding routine requires attention.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so the exploitation probability is unknown but the impact is high. An attacker can remotely deliver a crafted VP8L image to a service using the vulnerable library, triggering excessive memory allocation and eventually exhausting system memory. The lack of a public exploit does not negate the risk; the weakness can be leveraged in a denial‑of‑service scenario with minimal prerequisites.