LZ4 vulnerable to Out-of-bounds Write

심각 9.8CVE-2014-125026 · GHSA-4wp2-8rm2-jgmh · GO-2020-0022 · Published 27/12/2022 · updated 17/06/2026

요약

CVE-2014-125026은(는) github.com/cloudflare/golz4, golz4 (cloudflare)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.2%, 전체 취약점의 67.0%보다 높음.
조치: 0.0.0-20140711154735-199f5f787806, 2014-07-11 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
github.com/cloudflare/golz4 Go	`< 0.0.0-20140711154735-199f5f787806`	`0.0.0-20140711154735-199f5f787806`
golz4 cloudflare	`< 2014-07-11`	`2014-07-11`

Description

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

NVD description

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

References

nvd.nist.gov/vuln/detail/CVE-2014-125026 · ADVISORY
cloudflare/golz4 · WEB
cloudflare/golz4 commit 199f5f7 · WEB
cloudflare/golz4 · PACKAGE
pkg.go.dev/vuln/GO-2020-0022 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free