Vulnerability · Published Apr 28, 2021 · Assigned by GitHub_M
CVE-2021-29482denial of service in github.com/ulikunitz/xz
High 7.5
In plain English
A high-severity infinite loop in xz from ulikunitz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-ulikunitz-xz | 0.5.6-2 | DEBIAN-CVE-2021-29482 |
| Debian:13 | golang-github-ulikunitz-xz | 0.5.6-2 | DEBIAN-CVE-2021-29482 |
| Debian:14 | golang-github-ulikunitz-xz | 0.5.6-2 | DEBIAN-CVE-2021-29482 |
| Go | github.com/ulikunitz/xz | 0.5.8 | GHSA-25xm-hr59-7c27 |
| Go | github.com/ulikunitz/xz | 0.5.8 | GO-2020-0016 |
| Ubuntu:22.04:LTS | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2021-29482 |
| Ubuntu:24.04:LTS | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2021-29482 |
| Ubuntu:25.10 | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2021-29482 |
| Ubuntu:26.04:LTS | golang-github-ulikunitz-xz | no fix listed | UBUNTU-CVE-2021-29482 |
Affected products (as reported)
Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H