CVE-2026-33813 is a denial of service vulnerability found in golang.org/x/image, specifically in the WEBP image parsing code. A remote attacker can supply a malformed WEBP image with an invalid, large size that triggers an integer overflow, leading to a panic and crash on 32-bit platforms. This causes the application to terminate unexpectedly, resulting in denial of service. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound). Red Hat has issued a security advisory (RHSA-2026:8291) and released patched versions of the golang1.26 packages as part of the Red Hat Hardened Images update, which includes the fix in ollama-fips version 0.30.11-r1.

The vulnerability allows remote attackers to cause a denial of service by crashing applications that parse malicious WEBP images on 32-bit platforms. There is no indication of confidentiality or integrity impact. The primary impact is availability degradation due to application crashes. No known exploits are reported in the wild at this time.

An official patch is available in ollama-fips version 0.30.11-r1 and corresponding golang1.26 packages released by Red Hat. Users should apply the update as provided by Red Hat Hardened Images RPMs to remediate this vulnerability. No additional mitigations are specified or required beyond applying the official fix.