https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:10:18.766144+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-26406 EUVD-2026-26406 2026-10-06T11:10:18.891673+00:00 EUVD-2026-26406 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29482 fkie_cve-2021-29482 2026-10-06T11:10:18.891718+00:00

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

 https://cve.radiocsirt.org/vuln/ghsa-25xm-hr59-7c27 GHSA-25xm-hr59-7c27 — github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS) 2026-10-06T11:10:18.891765+00:00

Affected: Go: github.com/ulikunitz/xz

### Impact

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.

### Patches

The problem has been fixed in release v0.5.8.

### Workarounds

Limit the size of the compressed file input to a reasonable size for your use case.

### References

The standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.

### For more information If you have any questions or comments about this advisory: * Open an issue in [xz](https://github.com/ulikunitz/xz/issues).

 https://cve.radiocsirt.org/vuln/gsd-2021-29482 gsd-2021-29482 2026-10-06T11:10:18.891817+00:00 gsd-2021-29482 https://cve.radiocsirt.org/vuln/rhsa-2021:2920 RHSA-2021:2920 — Red Hat Security Advisory: OpenShift Virtualization 4.8.0 Images 2026-10-06T11:10:18.891840+00:00

golang-github-gorilla-websocket: integer overflow leads to denial of service golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference golang: crypto/elliptic: incorrect operations on the P-224 curve gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation ulikunitz/xz: Infinite loop in readUvarint allows for denial of service

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29482 UBUNTU-CVE-2021-29482 2026-10-06T11:10:18.891879+00:00

Affected: Ubuntu:20.04:LTS: golang-github-ulikunitz-xz, Ubuntu:22.04:LTS: golang-github-ulikunitz-xz, Ubuntu:24.04:LTS: golang-github-ulikunitz-xz, Ubuntu:25.10: golang-github-ulikunitz-xz, Ubuntu:26.04:LTS: golang-github-ulikunitz-xz

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0970 WID-SEC-W-2022-0970 — Red Hat OpenShift: Mehrere Schwachstellen 2026-10-06T11:10:18.891935+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.