https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:57:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-26406 EUVD-2026-26406 https://cve.radiocsirt.org/vuln/euvd-2026-26406 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29482 <p>xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.</p> <p>xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-29482 https://cve.radiocsirt.org/vuln/ghsa-25xm-hr59-7c27 <p><strong>Affected:</strong> Go: github.com/ulikunitz/xz</p> <p>### Impact</p> <p>xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.</p> <p>### Patches</p> <p>The problem has been fixed in release v0.5.8.</p> <p>### Workarounds</p> <p>Limit the size of the compressed file input to a reasonable size for your use case.</p> <p>### References</p> <p>The standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [xz](https://github.com/ulikunitz/xz/issues).</p> <p><strong>Affected:</strong> Go: github.com/ulikunitz/xz</p> <p>### Impact</p> <p>xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.</p> <p>### Patches</p> <p>The problem has been fixed in release v0.5.8.</p> <p>### Workarounds</p> <p>Limit the size of the compressed file input to a reasonable size for your use case.</p> <p>### References</p> <p>The standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in [xz](https://github.com/ulikunitz/xz/issues).</p> https://cve.radiocsirt.org/vuln/ghsa-25xm-hr59-7c27 https://cve.radiocsirt.org/vuln/gsd-2021-29482 gsd-2021-29482 https://cve.radiocsirt.org/vuln/gsd-2021-29482 https://cve.radiocsirt.org/vuln/rhsa-2021:2920 <p>golang-github-gorilla-websocket: integer overflow leads to denial of service golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference golang: crypto/elliptic: incorrect operations on the P-224 curve gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation ulikunitz/xz: Infinite loop in readUvarint allows for denial of service</p> <p>golang-github-gorilla-websocket: integer overflow leads to denial of service golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference golang: crypto/elliptic: incorrect operations on the P-224 curve gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation ulikunitz/xz: Infinite loop in readUvarint allows for denial of service</p> https://cve.radiocsirt.org/vuln/rhsa-2021:2920 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29482 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: golang-github-ulikunitz-xz, Ubuntu:22.04:LTS: golang-github-ulikunitz-xz, Ubuntu:24.04:LTS: golang-github-ulikunitz-xz, Ubuntu:25.10: golang-github-ulikunitz-xz, Ubuntu:26.04:LTS: golang-github-ulikunitz-xz</p> <p>xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: golang-github-ulikunitz-xz, Ubuntu:22.04:LTS: golang-github-ulikunitz-xz, Ubuntu:24.04:LTS: golang-github-ulikunitz-xz, Ubuntu:25.10: golang-github-ulikunitz-xz, Ubuntu:26.04:LTS: golang-github-ulikunitz-xz</p> <p>xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-29482 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0970 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0970