| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/go-getter | < 1.7.0 | 1.7.0 |
| github.com/hashicorp/go-getter/v2 | ≥ 2.0.0, < 2.2.0 | 2.2.0 |
| go-getter | = 2.1.1≤ 1.6.2 |
HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free