Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/ulikunitz/xz

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3GoPublished

    github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

    CVE-2025-58058 · GHSA-jc7w-c686-c4v9

    Affected
    • Go github.com/ulikunitz/xz <= 0.5.13
    Fixed in
    0.5.15· Vendor fix available
    Issue
    It is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. Mitigations The release v0.5.15 includes following mitigations: - The ReaderConfig DictCap field is now interpreted as a limit for the dictionary size. - The default is 2 Gigabytes - 1 byte (2^31-1 bytes). - Users can check with the [Reader.Header] method what the actual values are in their LZMA files and set a smaller limit using ReaderConfig. - The dictionary size will not exceed the larger of the file size and the minimum dictionary size. This is…

    Recommended action: Upgrade to 0.5.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5GoPublished

    github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)

    CVE-2021-29482 · GHSA-25xm-hr59-7c27

    Affected
    • Go github.com/ulikunitz/xz < 0.5.8
    Fixed in
    0.5.8· Vendor fix available
    Issue
    Impact xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. Patches The problem has been fixed in release v0.5.8. Workarounds Limit the size of the compressed file input to a reasonable size for your use case. References The standard library had recently the same issue and got the CVE-2020-16845 allocated. For more information If you have any questions or comments about this advisory: Open an issue in xz.

    Recommended action: Upgrade to 0.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →