What is GHSA-q7rw-w4cq-2j6w?

GHSA-q7rw-w4cq-2j6w is a security advisory published by GitHub Security Advisories with Medium severity. bep/imagemeta allows excessively large EXIF data structures

Which CVE IDs does GHSA-q7rw-w4cq-2j6w cover?

GHSA-q7rw-w4cq-2j6w covers the following CVE IDs: CVE-2025-32024. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-q7rw-w4cq-2j6w?

GHSA-q7rw-w4cq-2j6w affects 1 product, including: go/github.com/bep/imagemeta:\u003c 0.10.0.

GHSA-q7rw-w4cq-2j6wMedium

bep/imagemeta allows excessively large EXIF data structures

Vendor

GitHub Security Advisories

Published

April 9, 2025

Last Modified

April 9, 2025

🔗 CVE IDs covered (1)

CVE-2025-32024 →

📋 Description

Impact

The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks.

Patches

v0.10.0 added LimitNumTags (default 5000) and LimitTagSize (default 10000) options.

🎯 Affected products1

go/github.com/bep/imagemeta:< 0.10.0

🔗 References (4)

https://github.com/bep/imagemeta/security/advisories/GHSA-q7rw-w4cq-2j6w
https://nvd.nist.gov/vuln/detail/CVE-2025-32024
https://github.com/bep/imagemeta/commit/4fd89616d8bf7f9bb892360d3fb19080ec2b4602
https://github.com/advisories/GHSA-q7rw-w4cq-2j6w