github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)

CAO 7.5CVE-2021-29482 · GHSA-25xm-hr59-7c27 · GO-2020-0016 · Công bố 28/04/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-29482 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng github.com/ulikunitz/xz, xz (xz project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.4%, cao hơn 73.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.5.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/ulikunitz/xz Go	`< 0.5.8`	`0.5.8`
xz xz_project	`< 0.5.8`	`0.5.8`

Mô tả

Impact

Patches

The problem has been fixed in release v0.5.8.

Workarounds

Limit the size of the compressed file input to a reasonable size for your use case.

References

The standard library had recently the same issue and got the CVE-2020-16845 allocated.

For more information

If you have any questions or comments about this advisory:

Open an issue in xz.

Mô tả của NVD

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.