GHSA-q6gq-997w-f55g

Source

https://github.com/advisories/GHSA-q6gq-997w-f55g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-q6gq-997w-f55g/GHSA-q6gq-997w-f55g.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q6gq-997w-f55g

Aliases

Withdrawn

2025-10-14T19:37:18Z

Published

2021-12-16T19:16:40Z

Modified

2025-10-14T19:37:19Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Withdrawn Advisory: Infinite loop in xz

Details

Withdrawn Advisory

This advisory has been withdrawn because alerts cannot be issued for the Go standard library at this time.

Original Description

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Database specific

{
    "nvd_published_at": "2020-08-06T18:15:00Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-835"
    ],
    "severity": "HIGH",
    "github_reviewed_at": "2021-06-18T22:05:40Z"
}

References

Affected packages

Go / github.com/ulikunitz/xz

Package

Name: github.com/ulikunitz/xz; View open source insights on deps.dev
Purl: pkg:golang/github.com/ulikunitz/xz

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.5.8