LZ4 vulnerable to Out-of-bounds Write

KRITISCH 9.8CVE-2014-125026 · GHSA-4wp2-8rm2-jgmh · GO-2020-0022 · Published 27/12/2022 · updated 17/06/2026

Kurz gesagt

CVE-2014-125026 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in github.com/cloudflare/golz4, golz4 (cloudflare).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.2%, höher als bei 67.0% aller Schwachstellen.
Abhilfe: auf 0.0.0-20140711154735-199f5f787806, 2014-07-11 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/cloudflare/golz4 Go	`< 0.0.0-20140711154735-199f5f787806`	`0.0.0-20140711154735-199f5f787806`
golz4 cloudflare	`< 2014-07-11`	`2014-07-11`

Description

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

NVD description

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

References

nvd.nist.gov/vuln/detail/CVE-2014-125026 · ADVISORY
cloudflare/golz4 · WEB
cloudflare/golz4 commit 199f5f7 · WEB
cloudflare/golz4 · PACKAGE
pkg.go.dev/vuln/GO-2020-0022 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free